7 ms·
Retrieving your browsing history through a CAPTCHA
- huhtenberg 5y agoSly and clever, but the demo's not working. That's all I see - https://i.imgur.com/zl1iv6O.png https://i.imgur.com/zl1iv6O.png Recent Firefox + uBlock.
- varun_ch 5y agoDo you have JavaScript disabled?
- huhtenberg 5y agoNo, not blocked. Nothing on the console too except that the loading of "plausible.js" was blocked. PS. Played with it a bit and .box divs are zero-height. You need to have some content in <a> tags for them to not collapse vertically. This fixes it (somewhat) - document.querySelectorAll('.box a').forEach(e => e.innerHTML = ' ') PPS. Also this .box rule is marked with "invalid property name" - aspect-ratio: 1/1
- varun_ch 5y agoThanks. I can't reproduce the issue on Chrome or Firefox (98), but I've just pushed an update that changes "aspect-ratio: 1/1", to "aspect-ratio: 1 / 1". Perhaps I needed those spaces. Let me know if that solves it. :) Edit: Looks like Firefox only got support for aspect-ratio in version 89, is your browser up to date?
- huhtenberg 5y agoI am on 88 and planning to stay on it for a while. Mozilla got way off track recently with their pointless UI changes and, more troubling, business "collaborations", so a conservative approach to updating is well-warranted.
- Aachen 5y agoOh nice, I always have trouble making realistic clickjaking demos. This is just perfect. Previously I put stuff like a play button on a funny video, and for a second click the skip button on an ad. This stuff is golden, you can get a nearly infinite amount of clicks out of it.
- deleted 5y ago[deleted]
- Anunayj 5y agoAre there any extensions that protect from this?
- shusaku 5y agoBasically the only defense is an extension that prevents styling for a visited link. But on the plus side to use this exploit you either need to be very specific about what sites you check or have the user clicking lots of links…
- lozenge 5y agoTor Browser is not vulnerable. I don't think you can defend against this by adding CSS rules, only removing them. Extensions would need to parse the entire CSS of a website and replace it, which would be cumbersome.
- Hnrobert42 5y agoI use Firefox Focus. It deletes your history each time you close the app. I find I never need my history, so I’m happy to have it deleted regularly. Others seem to use their history and tabs, so YMMV.
- rightbyte 5y agoThis is a terrible PI leak ... JS should really be disabled by default and only be enabled on sites that really need it and you somewhat trust.
- cabirum 5y agoIt does not require js to work. In essense, it uses css styles to exploit visited links.
- zinekeller 5y agoAlso, lying the visited state on JS was implemented as early as Firefox 4 - so it is definitely not a JS-dependent "exploit" (rather, it's a rather oblique way of social engineering).
- PetahNZ 5y agoBut dont you need js to check for the styles to see if the link is visited?
- vgel 5y agoNo, each square the user clicks could be a checkbox that is submitted to the backend as a form when they click done.
- kevincox 5y agoIt could even just use CSS selectors to reveal an image or change a background image that results in a request to the backend.
- varun_ch 5y agoFortunately most browsers already have some measures to prevent that (https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_:visited_selector https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...), the demo avoids automating the process altogether, and relies on tricking the visitor into 'voluntarily' telling if they've visited a site.
- xPaw 5y agoI rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.
- mmahemoff 5y agoThe only time I ever see a visited style link is when links aren't styled at all. It's anachronistic and the feature should probably be dropped altogether. If some users want to see it, it could be done with an extension that has history access (or a coarse-grained version of history). Then they'd be able to see it for all sites, not just the tiny fraction of sites that don't style links.
- shkkmo 5y agoThis is clearly not true as you are currently posting on a site that has styled links and also has lighter styled visited links.
- hackerfromthefu 5y agoCounterpoint, plenty of sites I use properly show visited links, and it's a very useful feature!
- mmahemoff 5y agoMaybe I don't notice it enough, but I suspect the vast majority of those are only doing it because they haven't changed the style. I find it useful too, but since most sites don't actually show it, I'd rather just use an extension that always shows it.
- hoesephgerrible 5y ago
- Pooge 5y agoWhat is going on with those new accounts preaching against online privacy recently? Edit: For the lurkers trying to educate themselves, I recommend those resources: https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Citizenfour https://en.wikipedia.org/wiki/Citizenfour https://vimeo.com/nothingtohide https://vimeo.com/nothingtohide
- AussieWog93 5y agoI don't think the new account was actually arguing against privacy (those words have basically become a strawman now); rather it was just a bit of dry humour.
- Pooge 5y agoI just reread the comment and maybe you are right. I don't know if he edited the comment or if I misread when I wrote my reply, but I didn't see the word "goes". So I read "I believe the argument [...]".
- charcircuit 5y ago>What is going on with those new accounts preaching against online privacy recently? From my experience (as I prefer freedom of information) if you are against privacy you tend to get downvoted. I think downvotes can lead to your account being rate limited which is annoying so it makes sense that people would want to use another account.
- ivan90210 5y ago
- yodon 5y agoPerhaps you're spotting recent reddit transplants who don't yet get HN's unique dislike of sarcasm and shallowly dismissive jokes?
- pabs3 5y agoFor Firefox at least, toggling layout.css.visited_links_enabled should fix this. An earlier article about the visited CSS issue: https://dbaron.org/mozilla/visited-privacy https://dbaron.org/mozilla/visited-privacy
- ck2 5y agoThe answer to having both visited styles and not security violations is to allow a domain to only style links that are local to that domain and not others. They already do that with referers, there is a security level to only let the site see referers that are local to its domain. I think this is the default for https
- hedora 5y agoCouldn't you reimplement cross-site cookies with that?
- jfkimmes 5y agoI believe this is not a new concept. However, I applaud the accessibility, style and implementation of the proof-of-concept, given that the author seems to be only 15! Also sidenote: I like the creative and subtle plug for the author's 'Quickz' project (seems to be a Kahoot alternative - I have never heard of either) in the "not visited category". Keep up the good work!
- varun_ch 5y agoThank you! :)
- jahirul247 5y ago
- jahirul247 5y ago[flagged]
- throwawayHN378 5y agoCool but this has been around since forever
- mistersquid 5y agoOn macOS Monterey 12.2.1 - Fails on Safari 15.3 - Works on Google Chrome 99.0.4844.51
- orliesaurus 5y agoI remember seeing the same concept applied to something else and a demo here on HN many years ago. This implementation however is novel, and feels more 'exploitable'. Good idea/nice find!
- Jap2-0 5y agoI was wondering why this wasn't working for me. Looking through my settings in Firefox, I finally narrowed it down to Privacy and Security -> History. I have it set to "use custom settings" (clear history on exit, everything else unchecked), but presumably "never remember history" would also work.
- deleted 5y ago[deleted]
- sebazzz 5y agoDoesn't work on Firefox iOS, even with enhanced tracking protection disabled. It only shows this single domain varun.ch. It does work on Firefox desktop.