5 ms·

SocialHistory.js: See Which Sites Your Users Visit

36 points by sant0sk1 18y ago

pchristensen 18y ago
http://azarask.in/blog/post/socialhistoryjs/ http://azarask.in/blog/post/socialhistoryjs/ http://news.ycombinator.com/item?id=201912 http://news.ycombinator.com/item?id=201912
Rickasaurus 18y ago
Phew, this is way less creepy than I thought from the title. At least they have to specify the sites.
auston 18y ago
http://news.ycombinator.com/item?id=78939 http://news.ycombinator.com/item?id=78939 You could use that as a barebones way to send data to google analytics or getclicky, or plug it in to a user profile (generated by yourself). Of course Aza's solution is waayyy more elegant. And I'm sure firefox/opera/webkit will be closing up this vulnerability in the near future.
- bouncingsoul 18y ago
  How do will they close this vulnerability? Make it impossible to check the color of text with javascript? I don't think that's going to happen. Besides you could easily check a different attribute. Maybe browsers should restrict the :visited attribute to one domain. Or maybe just base it on a daily history instead of your all-inclusive one.
- martian 18y ago
  This is cool. Last summer I had an inkling of an idea that used basically the same strategy. My idea (never implemented) was to set the background images on visited anchors to a dynamic image url that could be used to track pageviews from other sites, to perhaps determine what links from your site your visitors found most interesting, even if they didn't click to them from your site. There are plenty of terrible use cases for something like this, but also plenty of benign and probably useful cases as well. If you were a search engine, for example, you could determine if a user has been to sites that show up in the search results, even if they don't click on the links from your site. The full write-up of my strategy is here: http://tinyurl.com/6fnjod http://tinyurl.com/6fnjod
bobp 18y ago
nice hack!
typicaljoe 18y ago
I wonder what other creative uses there are for this. For example, if someone visits digg you know they are likely to be a techie. If they visit seattle.craigslist.com you know they are likely to be in Seattle. If they visit drudgereport they may be a news buff. You could create a collection and if there user uses your site a lot you could try hundreds of things and pass them back to the server....interesting...
JacobAldridge 18y ago
I'm suffering severe internal ambivalence; this is either great or terrible. Business part of Jacob's brain: "Great" User part of Jacob's brain: "Terrible" I wonder how the public would split? And then I realise there will always be more users than businesses.
rapind 18y ago
clever
mojuba 18y ago
This is not the scariest hack that can be done with HTML/JS. There is another one that checks if you are logged in to some web site, your bank for instance. Once a malicious page finds a site you are in, a hidden iframe can click on links and even submit forms on your behalf.

36 points by sant0sk1 18y ago

http://azarask.in/blog/post/socialhistoryjs/ http://azarask.in/blog/post/socialhistoryjs/ http://news.ycombinator.com/item?id=201912 http://news.ycombinator.com/item?id=201912

Rickasaurus 18y ago

Phew, this is way less creepy than I thought from the title. At least they have to specify the sites.

auston 18y ago

http://news.ycombinator.com/item?id=78939 http://news.ycombinator.com/item?id=78939 You could use that as a barebones way to send data to google analytics or getclicky, or plug it in to a user profile (generated by yourself). Of course Aza's solution is waayyy more elegant. And I'm sure firefox/opera/webkit will be closing up this vulnerability in the near future.

bouncingsoul 18y ago
How do will they close this vulnerability? Make it impossible to check the color of text with javascript? I don't think that's going to happen. Besides you could easily check a different attribute. Maybe browsers should restrict the :visited attribute to one domain. Or maybe just base it on a daily history instead of your all-inclusive one.
martian 18y ago
This is cool. Last summer I had an inkling of an idea that used basically the same strategy. My idea (never implemented) was to set the background images on visited anchors to a dynamic image url that could be used to track pageviews from other sites, to perhaps determine what links from your site your visitors found most interesting, even if they didn't click to them from your site. There are plenty of terrible use cases for something like this, but also plenty of benign and probably useful cases as well. If you were a search engine, for example, you could determine if a user has been to sites that show up in the search results, even if they don't click on the links from your site. The full write-up of my strategy is here: http://tinyurl.com/6fnjod http://tinyurl.com/6fnjod

bobp 18y ago

nice hack!

typicaljoe 18y ago

I wonder what other creative uses there are for this. For example, if someone visits digg you know they are likely to be a techie. If they visit seattle.craigslist.com you know they are likely to be in Seattle. If they visit drudgereport they may be a news buff. You could create a collection and if there user uses your site a lot you could try hundreds of things and pass them back to the server....interesting...

JacobAldridge 18y ago

I'm suffering severe internal ambivalence; this is either great or terrible. Business part of Jacob's brain: "Great" User part of Jacob's brain: "Terrible" I wonder how the public would split? And then I realise there will always be more users than businesses.

rapind 18y ago

clever

mojuba 18y ago

This is not the scariest hack that can be done with HTML/JS. There is another one that checks if you are logged in to some web site, your bank for instance. Once a malicious page finds a site you are in, a hidden iframe can click on links and even submit forms on your behalf.