4 ms·
This article would more accurately be named the CSS :visited psuedo-class is bad for your browser history, not blaming it on the mix-blend-mode property. The s
by bennettfeely 10y ago
This article would more accurately be named the CSS :visited psuedo-class is bad for your browser history, not blaming it on the mix-blend-mode property.
The same idea has been done before, except more cleverly with the color property and captchas:
https://frantzmiccoli.github.io/visited-captcha-history/ https://frantzmiccoli.github.io/visited-captcha-history/
- allendoerfer 10y agoThey should just kill it already if they do not want to work around this forever, since CSS will only grow.
- LukeShu 10y agoDid you read the article? It explains how browsers mitigated the :visited pseudo-class issue, then how he bypassed that mitigation using mix-blend-mode. As presented, mix-blend-mode absolutely is to blame for being able to exploit it. He also explains how this is different than the captcha POF that you linked because the captcha requires user interaction for each URL tested (something that wasn't necessary before the browsers mitigated against it). He explains how to reduce this to a single user interaction, by exploiting mix-blend-mode. Yes, :visited is a key part of the exploit, but to say it's just that isn't accurate.
- ianstormtaylor 10y agoI think grandparent's point is that `:visited` is actually the source of the problem, and that the "fixes" that browsers applied were leaky. Surely this will continue happening with future additions to CSS. It seems like a perfect example of leaky abstractions.
- eriknstr 10y agoI think the title is very good because I am aware of problems and mitigations with :visited, so if the title just talked about :visited, I would have thought to myself, "yup, good thing they fixed that long ago in all browsers", whereas with the present title, I actually learned about these new discoveries.