5 ms·

It does not require js to work. In essense, it uses css styles to exploit visited links.

zinekeller 5y ago
Also, lying the visited state on JS was implemented as early as Firefox 4 - so it is definitely not a JS-dependent "exploit" (rather, it's a rather oblique way of social engineering).
PetahNZ 5y ago
But dont you need js to check for the styles to see if the link is visited?
- vgel 5y ago
  No, each square the user clicks could be a checkbox that is submitted to the backend as a form when they click done.
  - kevincox 5y ago
    It could even just use CSS selectors to reveal an image or change a background image that results in a request to the backend.
    - varun_ch 5y ago
      Fortunately most browsers already have some measures to prevent that (https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_:visited_selector https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...), the demo avoids automating the process altogether, and relies on tricking the visitor into 'voluntarily' telling if they've visited a site.
      - kevincox 5y ago
        I meant you can use CSS on the checkbox once it is checked, there is no need to actually submit a form. I understand that you can't use CSS directly on the :visited selector.
        varun_ch 5y ago
        Ah I see, that makes sense.
rightbyte 5y ago
You need js to extract the PI though?
- leodriesch 5y ago
  This one does not really need JS, the captcha could be done with an HTML form and checkboxes.
  - sylware 5y ago
    captchas which are not working with noscript/basic (x)html browsers are definitive no-no anyway.
- fam0r 5y ago
  You can do requests to the site using pure CSS as well, using something like `.site:visited { background-image: url(/logging/site); }`
  - unilynx 5y ago
    those kind of tricks are already blocked by browsers, as the article explains
- gowld 5y ago
  JS or user submitting a form -- some form of client interaction.
madacol 5y ago
I had to enable js for it to work in firefox

Also, lying the visited state on JS was implemented as early as Firefox 4 - so it is definitely not a JS-dependent "exploit" (rather, it's a rather oblique way of social engineering).

PetahNZ 5y ago

But dont you need js to check for the styles to see if the link is visited?

vgel 5y ago
No, each square the user clicks could be a checkbox that is submitted to the backend as a form when they click done.
- kevincox 5y ago
  It could even just use CSS selectors to reveal an image or change a background image that results in a request to the backend.
  - varun_ch 5y ago
    Fortunately most browsers already have some measures to prevent that (https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_:visited_selector https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...), the demo avoids automating the process altogether, and relies on tricking the visitor into 'voluntarily' telling if they've visited a site.
    - kevincox 5y ago
      I meant you can use CSS on the checkbox once it is checked, there is no need to actually submit a form. I understand that you can't use CSS directly on the :visited selector.
      - varun_ch 5y ago
        Ah I see, that makes sense.

rightbyte 5y ago

You need js to extract the PI though?

leodriesch 5y ago
This one does not really need JS, the captcha could be done with an HTML form and checkboxes.
- sylware 5y ago
  captchas which are not working with noscript/basic (x)html browsers are definitive no-no anyway.
fam0r 5y ago
You can do requests to the site using pure CSS as well, using something like `.site:visited { background-image: url(/logging/site); }`
- unilynx 5y ago
  those kind of tricks are already blocked by browsers, as the article explains
gowld 5y ago
JS or user submitting a form -- some form of client interaction.

madacol 5y ago

I had to enable js for it to work in firefox