People have been using this technique in this way since at least 2006: http://int2e.com/blog/improved-digg-integration-script/ http://int2e.com/blog/improved-di

People have been using this technique in this way since at least 2006: http://int2e.com/blog/improved-digg-integration-script/ http://int2e.com/blog/improved-digg-integration-script/ http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo... Since changing browsers to prevent this will not happen tomorrow, this can be partially worked around both server and client-side. Server-side: If you have any sensitive URIs you don't want leaked or brute-forced, add an extra parameter containing a random value. URIs you might want to protect are those with XSRF tokens or session IDs. URIs can be brute-forced locally on the victim at a speed of approximately 40,000 URIs per second. Client-side: Use incognito mode for sensitive surfing. Plugins such as noscript can partially defend against this, however it's possible to do history detection using pure CSS which I believe will work even if you're using noscript. Update: Fixnum posted another client-side solution "in Firefox, go to about:config and turn off layout.css.visited_links_enabled"