4 ms·

Would you care to enlighten us houseplants as to how? The :visited selector is limited to a very small subset of CSS properties[1] for exactly this reason; I’m

Would you care to enlighten us houseplants as to how? The :visited selector is limited to a very small subset of CSS properties[1] for exactly this reason; I’m sure if you have an exploit that can be used to extract browsing history the browsers will be very interested in a security report. [1]: https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_:visited_selector https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...

brigandish 5y ago
Check the colours of links, if they're blue, they're new, if they're purple, they've been visited. It works the same way for anyone looking at the page, not just the user's eyes.
- codeafin 5y ago
  What's the last product you've seen that still uses this color system?
  - pkqxdd 5y ago
    Google search
    - jfk13 5y ago
      Sure, it shows those colours to the user. But they're not exposed to the website; if it tries querying the colour of the links, the browser returns the same blue value for all of them, visited or not.
      - JacobThreeThree 5y ago
        It used to be that CSS leaked all visitor states with no user interaction. This was patched by browsers a few years back, but there are still ways to extract some data from :visited, it just requires user interaction now. https://frantzmiccoli.github.io/visited-captcha-history/ https://frantzmiccoli.github.io/visited-captcha-history/
        SahAssar 5y ago
        That's pretty limited though. You can only check urls (not domains), and only as many urls as there are characters in the captcha. It's a clever hack though!
- easrng 5y ago
  That's not true, did you read the MDN page? > The window.getComputedStyle method, and similar functions such as element.querySelector, will always return values indicating that a user has never visited any of the links on a page.
  - worg 5y ago
    if one's feeling determined and creative there's the possibility to render the link to a canvas and get pixel colors
    - EE84M3i 5y ago
      I believe if you can do this, it would be considered an exploit. You're not supposed to be able to.
    - SahAssar 5y ago
      IIRC rendering the html to a canvas is done with a empty history, so all links will look unvisited.
    - easrng 5y ago
      Links in images are always rendered as unvisited. See https://output.jsbin.com/wowalokusa https://output.jsbin.com/wowalokusa, the first is an HTML link, the second is a link in an SVG, the third is a link in an SVG in an image.
    - worg 5y ago
      yep, it seems I was mistaken, rendering links to SVG/Canvas wouldn't work
  - brigandish 5y ago
    I did, before it was fixed[1]: > For many years the CSS :visited selector has been a vector for querying a user’s history. It’s not particularly dangerous by itself, but when it’s combined with getComputedStyle() in JavaScript it means that someone can walk through your history and figure out where you’ve been. And quickly – some tests show the ability to test 210,000 URLs per minute. At that rate, it’s possible to brute force a lot of your history or at least establish your identity through fingerprinting. Given that browsers often keep history for a long time it can reveal quite a bit about where you’ve been on the web. > At Mozilla we’re serious about protecting people’s privacy, so we’re going to fix this problem for our users. [1] https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ https://hacks.mozilla.org/2010/03/privacy-related-changes-co... Regardless of it being fixed (thanks for the update) it's still possible to do this via timing attacks. I wouldn't be surprised if the sieve that is a browser still allowed it in some other way.
deleted 5y ago
[deleted]

brigandish 5y ago

Check the colours of links, if they're blue, they're new, if they're purple, they've been visited. It works the same way for anyone looking at the page, not just the user's eyes.

codeafin 5y ago
What's the last product you've seen that still uses this color system?
- pkqxdd 5y ago
  Google search
  - jfk13 5y ago
    Sure, it shows those colours to the user. But they're not exposed to the website; if it tries querying the colour of the links, the browser returns the same blue value for all of them, visited or not.
    - JacobThreeThree 5y ago
      It used to be that CSS leaked all visitor states with no user interaction. This was patched by browsers a few years back, but there are still ways to extract some data from :visited, it just requires user interaction now. https://frantzmiccoli.github.io/visited-captcha-history/ https://frantzmiccoli.github.io/visited-captcha-history/
      - SahAssar 5y ago
        That's pretty limited though. You can only check urls (not domains), and only as many urls as there are characters in the captcha. It's a clever hack though!
easrng 5y ago
That's not true, did you read the MDN page? > The window.getComputedStyle method, and similar functions such as element.querySelector, will always return values indicating that a user has never visited any of the links on a page.
- worg 5y ago
  if one's feeling determined and creative there's the possibility to render the link to a canvas and get pixel colors
  - EE84M3i 5y ago
    I believe if you can do this, it would be considered an exploit. You're not supposed to be able to.
  - SahAssar 5y ago
    IIRC rendering the html to a canvas is done with a empty history, so all links will look unvisited.
  - easrng 5y ago
    Links in images are always rendered as unvisited. See https://output.jsbin.com/wowalokusa https://output.jsbin.com/wowalokusa, the first is an HTML link, the second is a link in an SVG, the third is a link in an SVG in an image.
  - worg 5y ago
    yep, it seems I was mistaken, rendering links to SVG/Canvas wouldn't work
- brigandish 5y ago
  I did, before it was fixed[1]: > For many years the CSS :visited selector has been a vector for querying a user’s history. It’s not particularly dangerous by itself, but when it’s combined with getComputedStyle() in JavaScript it means that someone can walk through your history and figure out where you’ve been. And quickly – some tests show the ability to test 210,000 URLs per minute. At that rate, it’s possible to brute force a lot of your history or at least establish your identity through fingerprinting. Given that browsers often keep history for a long time it can reveal quite a bit about where you’ve been on the web. > At Mozilla we’re serious about protecting people’s privacy, so we’re going to fix this problem for our users. [1] https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ https://hacks.mozilla.org/2010/03/privacy-related-changes-co... Regardless of it being fixed (thanks for the update) it's still possible to do this via timing attacks. I wouldn't be surprised if the sieve that is a browser still allowed it in some other way.

deleted 5y ago

[deleted]