Slashdot Mirror
76% of Web Users Affected By Browser History Stealing
An anonymous reader writes "Web browser history detection with the CSS:visited trick has been known for the last ten years, but recently published research suggests that the problem is bigger than previously thought. A study of 243,068 users found that 76% of them were vulnerable to history detection by malicious websites. Newer browsers such as Safari and Chrome were even more affected, with 82% and 94% of users vulnerable. An average of 63 visited locations were detected per user, and for the top 10% of users the tests found over 150 visited sites. The website has a summary of the findings; the full paper (PDF) is available as well."
Hey Taco! "Vulnerable" and "Affected by" are not synonyms.
Three Squirrels
Well for starters, I can email you a joke of the day and log whether you've been to the craigslist personals lately. Your wife might not like knowing that.
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
People generally use the same or similar usernames and passwords for most of their online identities. If you you know someone in particular uses facebook.com, hotmail.com, kittenwar.com and randombank.com you can use facebook and kittenwar as attack vectors against their email and banks. Alone, history sniffing does not present a huge threat. But it can dramatically increase someones vulnerability to identity theft.
Doesn't unchecking the "keep my history" button under "privacy" take care of this?
Eloi are stupid, throw morlocks at them!
There's a difference between my service provider potentially having the information, and some random website I happen to visit having it.
It's official. Most of you are morons.
who the hell reads "joke of the day" emails?
I tried...I tried really hard and almost soiled myself with the effort, but I just can't care about my browser history being "stolen".
that's like calling my garbage being stolen every week when the big truck comes and takes it away.
Hell, the more time people spend stealing browser histories is time they're not spending doing something I do care about, so keep at it!
I think the most appropriate way is to prevent :visited from applying to any URL not within the current domain.
If I have been able to see further than others, it is because I bought a pair of binoculars.
It used to be an important/useful feature of the web/html -- until "website designers" decided that they didn't like the look and started making certain that all links looked the same, and other things that also made it stop working.
I have a question - why the ****** does a website need to have/see/retreive the list of URLs I've been at in order to do this - coloring links is a browser side feature! The only thing a website needs to do is suggest which colors to use for said links.
This was grossly unintentional right? Someone didn't choose to implement this specific behaviour, right?
But when looking for a new car you get certain feelings about certain brands. When you're looking at a chevy truck you'll get a feeling that its really solid (Like a Rock!) that Ford looks like its durable (Ford Tough!) and when you look at a mazda you'll get the feeling that this car has really got some pep (zoom! zoom!).
Those little jingles and slogans may not even pop into your head while test driving but they're there and have an influence over your purchasing decision. Sure you'll look at the price and all the other considerations, but if the Mazda is only a couple of hundred dollars more but it just felt more fun to drive, well you'll pay the extra to get the zoom zoom.
The problem with that is that will break the page layout for any links which are external to your site. I think the best way to handle it would be to preload all :visited related images at page load. Needed or not. This will result in expected page layout, and it won't be possible to infer which links where already visited. Possibly a memory hog, but browsers can also detect when a page tried to load 10,000 :visited related images and flag as possibly malicious.
Firefox development versions don't have this issue. The last shipped release does. But were you comparing apples (cutting edge development builds) to oranges (releases that shipped a while back)?