Slashdot Mirror
History Sniffing In the Wild
An anonymous reader writes "Kashmir Hill at Forbes documents a recent study by UCSD researchers showing that 'history sniffing' is being actively used by mainstream ad networks like Interclick as well as popular porn sites like YouPorn in order to track what other sites you visit. The vulnerability has been known for almost a decade, but this paper documents hundreds of commercial sites exploiting it today (PDF)."
The fact that they intentionally obfuscated the code means that they KNEW this would piss people off, and were hoping to just bore curious folk by presenting seemingly random characters.
I live in constant fear of the Coming of the Red Spiders.
...using Chrome in incognito mode. It determined I had visited...
...startpanic.com
So yeah, use incognito/private browsing mode.
Open about:config
Set layout.css.visited_links_enabled to false
Reviewing just the first hour of video games.
You should smell some of the "history" in the back of MY fridge.
When our name is on the back of your car, we're behind you all the way!
Steve Jobs told me that it's going to be super secure
If I gave you some random code, did not tell you what exactly it did but asked you to run it, would you run it? That is basically what is happening when you browse with Javascript enabled -- you are allowing websites to run essentially arbitrary code on your computer.
Palm trees and 8
If you're trying to explain how all these kinds of things work, you need to be more precise. And I say precise not to please geeks, but to help the layman audience understand what is really important.
This should have been written as "a script stored on the site and offered to the browser, which the browser elects to download and run, runs on your computer and exploits a privacy leak..."
It's not that summarizing it as "a script on the site" is wrong; it's technically correct in a pedantic[*] way, to say the script is on the site, since that does happen to be where it's stored. But we're not ever going to have a technically literate and informed public OR LEGISLATORS (and they are getting mentioned in this article; their knowledge or lack thereof is critical since they're threatening to pass laws related to this topic) if we continue to leave out the most important and fundamental aspect of how most privacy leaks happen.
The same goes for the mention of cookies.
Never in the history of the web, has any network placed a cookie on someone's computer. Just as above, that is a seemingly-convenient shorthand, but it actually obfuscates the truth to such an immense degree that anyone who tries to make decisions (I'm looking at you, lawmakers) will totally get all their policies wrong.
Servers offer cookies. User agents place cookies on people's computers, completely voluntarily.
[*] Pedantic. It might sound like I'm being the pedantic one here, but the essence of pedantry is to focus on irrelevant truths, such as defending the truth of a statement that a script is "on a site" because the master copy happens to be stored on the site. Such truths are a deception, because a script on a site has very little power. It's only when other computers choose to get and run that script, that the script starts to really do things.
What I'm getting at is that for these client-side problems, we need to present and think about them as client-side problems.
In Firefox, even older versions (and perhaps some of the other browsers out there), you can change your "visited links" color (via Edit, Preferences, Appearance, Colors) to something other than purple. Then this script won't work. More, if you also change the "unvisited links" color, then even a modified script designed to tell the difference won't know which color is your "visited" color and which is your "unvisited" color.
My recommendation is to use multiple browsers.
Say you use Firefox for your web searches.
Then run Facebook on Safari (say)
Anything google on Opera.
Any porn on Chrome.
Etc.
There are a bunch of broswers out there - use them to silo off the nosey actors like Facebook, Google and Youporn.