Slashdot Mirror
History Sniffing In the Wild
An anonymous reader writes "Kashmir Hill at Forbes documents a recent study by UCSD researchers showing that 'history sniffing' is being actively used by mainstream ad networks like Interclick as well as popular porn sites like YouPorn in order to track what other sites you visit. The vulnerability has been known for almost a decade, but this paper documents hundreds of commercial sites exploiting it today (PDF)."
The fact that they intentionally obfuscated the code means that they KNEW this would piss people off, and were hoping to just bore curious folk by presenting seemingly random characters.
I live in constant fear of the Coming of the Red Spiders.
...using Chrome in incognito mode. It determined I had visited...
...startpanic.com
So yeah, use incognito/private browsing mode.
I had basically assumed (semi subconsciously) all along that websites I was visiting could have some idea of what other websites I had been to, or at least toyed with the thought.
I am unfazed, and not surprised. *shrug*
it's all the spitting. WTF is up with that?
I tried it and it reeks of mildew, stale dust particles and mold spores.
He who knows best knows how little he knows. - Thomas Jefferson
Open about:config
Set layout.css.visited_links_enabled to false
Reviewing just the first hour of video games.
Steve Jobs told me that it's going to be super secure
If I gave you some random code, did not tell you what exactly it did but asked you to run it, would you run it? That is basically what is happening when you browse with Javascript enabled -- you are allowing websites to run essentially arbitrary code on your computer.
Palm trees and 8
If you're trying to explain how all these kinds of things work, you need to be more precise. And I say precise not to please geeks, but to help the layman audience understand what is really important.
This should have been written as "a script stored on the site and offered to the browser, which the browser elects to download and run, runs on your computer and exploits a privacy leak..."
It's not that summarizing it as "a script on the site" is wrong; it's technically correct in a pedantic[*] way, to say the script is on the site, since that does happen to be where it's stored. But we're not ever going to have a technically literate and informed public OR LEGISLATORS (and they are getting mentioned in this article; their knowledge or lack thereof is critical since they're threatening to pass laws related to this topic) if we continue to leave out the most important and fundamental aspect of how most privacy leaks happen.
The same goes for the mention of cookies.
Never in the history of the web, has any network placed a cookie on someone's computer. Just as above, that is a seemingly-convenient shorthand, but it actually obfuscates the truth to such an immense degree that anyone who tries to make decisions (I'm looking at you, lawmakers) will totally get all their policies wrong.
Servers offer cookies. User agents place cookies on people's computers, completely voluntarily.
[*] Pedantic. It might sound like I'm being the pedantic one here, but the essence of pedantry is to focus on irrelevant truths, such as defending the truth of a statement that a script is "on a site" because the master copy happens to be stored on the site. Such truths are a deception, because a script on a site has very little power. It's only when other computers choose to get and run that script, that the script starts to really do things.
What I'm getting at is that for these client-side problems, we need to present and think about them as client-side problems.
In Firefox, even older versions (and perhaps some of the other browsers out there), you can change your "visited links" color (via Edit, Preferences, Appearance, Colors) to something other than purple. Then this script won't work. More, if you also change the "unvisited links" color, then even a modified script designed to tell the difference won't know which color is your "visited" color and which is your "unvisited" color.
My recommendation is to use multiple browsers.
Say you use Firefox for your web searches.
Then run Facebook on Safari (say)
Anything google on Opera.
Any porn on Chrome.
Etc.
There are a bunch of broswers out there - use them to silo off the nosey actors like Facebook, Google and Youporn.
See http://blogs.msdn.com/b/ieinternals/archive/2009/06/17/csshistoryprobing.aspx
As pointed out by PZ Myers http://scienceblogs.com/pharyngula/2010/12/another_reason_to_avoid_visiti.php // CREATIONIST GROUPIES
The comments in their javascript are kind of funny.In particular,
Compressing code into a near-unreadable terse format to reduce transmission bandwidth is not "obfuscation" it's "compression".
Obfuscation has, as a trademark, the addition of operations intended to obscure the function of the code. Compressed code doesn't particularly obscure the function, though it usually obscures the purpose of the coded operations.
Example: "++a;" is compressed and obscure to purpose as we don't know what _a_ represents nor why incrementing it by one is significant. This is compressed code.
Example: "aeradewd=1; /* long body of code */ aeradewd = ~aeradewd; /*long body of code */ wierakex --= aeradewd;" is obfuscated code, while it is no more clear that _a_ and _wierakex_ are analogous, deliberate gymnastics have been undertaken to "hide" the fact that _wierakex_ is being incremented by one. This is obfuscated code.
Obfuscated code is usually less efficient, but it doesn't have to be. in the obfuscated case, if the incrementor factor had been constant, and the ~ operator had been used to initialize second constant instead of altering a variable, then the compiler would have seen the final "--= -1" and converted that into an increment operation.
So "poor programming practices" and frankly old-school variable and function names (possibly as the result of a global search-and-replace of good names for terse ones) is unfriendly to your eyes, but falls far short of the verb "to (deliberately) obfuscate". When done to reduce network consumption and improve page load times, you are in the realm of completely legitimate action. At that point you might as well complain that compilation is an act of obfuscation undertaken just to inconvenience you.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press