4 ms·
Did you read the article? It explains how browsers mitigated the :visited pseudo-class issue, then how he bypassed that mitigation using mix-blend-mode. As pr
by LukeShu 10y ago
Did you read the article? It explains how browsers mitigated the :visited pseudo-class issue, then how he bypassed that mitigation using mix-blend-mode. As presented, mix-blend-mode absolutely is to blame for being able to exploit it.
He also explains how this is different than the captcha POF that you linked because the captcha requires user interaction for each URL tested (something that wasn't necessary before the browsers mitigated against it). He explains how to reduce this to a single user interaction, by exploiting mix-blend-mode.
Yes, :visited is a key part of the exploit, but to say it's just that isn't accurate.
- ianstormtaylor 10y agoI think grandparent's point is that `:visited` is actually the source of the problem, and that the "fixes" that browsers applied were leaky. Surely this will continue happening with future additions to CSS. It seems like a perfect example of leaky abstractions.
- eriknstr 10y agoI think the title is very good because I am aware of problems and mitigations with :visited, so if the title just talked about :visited, I would have thought to myself, "yup, good thing they fixed that long ago in all browsers", whereas with the present title, I actually learned about these new discoveries.