13 ms·
Who am I: A mind reader (don't forget to view source)
- lewisflude 12y agoThis was really accurate to me. It seems they're using a:visited on several domains to create the "red square" effect.
- cynwoody 12y agoYes. And the only reason you have to click the red squares is to let it know which ones are red. If you try to look up the color of a square using GetComputedStyle, it always comes back gray. That was the resolution of privacy Bug 147777† (":visited support allows queries into global history"). †https://bugzilla.mozilla.org/show_bug.cgi?id=147777 https://bugzilla.mozilla.org/show_bug.cgi?id=147777
- pbhjpbhj 12y agoWhat about if you make a screen capture from the page and use coordinates to read back the colours and correlate with the URLs? Seems a possibility based on http://stackoverflow.com/questions/9250505/how-to-upload-a-screenshot-using-html2canvas http://stackoverflow.com/questions/9250505/how-to-upload-a-s....
- aendruk 12y agohtml2canvas constructs its "screenshots" using information from the DOM, so that wouldn't gain you anything but unnecessary complexity.
- pbhjpbhj 12y agoAh, OK, and other methods appear to produce blank images so presumably this route is purposefully locked down too. A java app or add-on would do it but they'd be a bit obvious for most users I'd think.
- joev_ 12y agoHeh. I clicked a few before I realized what was going on (looking at the status bar shows the link, which somewhat gives it away). You could prevent this by adding mouseover/out and onclick logic that removed the :href on hover and just colored itself red.
- asadlionpk 12y agobut i guess then it won't be red on hover.
- martin-adams 12y agoBut in that case, you can add CSS to make it red on hover.
- zenjzen 12y agonice.
- shurcooL 12y agoReminds me of that hunter2 password thing. http://www.bash.org/?244321 http://www.bash.org/?244321 Basically, the website doesn't know which of the squares are red, that depends on your browser state. By clicking the red squares, you're feeding it data. The interesting observation I made out of this is that navigating there in an incognito window prevents any links from being considered as visited. That's good to know.
- SahAssar 12y agoI remember reading about the old CSS history hack (an automated variation of the same theme), which worked until FF4 and IE9. It's quite interesting to see how such a seemingly simple feature (a:visited) can completely override user privacy if not accounted for.
- irises_come 12y agoHm. Do you really need interaction at all? Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?
- gburt 12y agoThis is a very old attack that has numerous security measures to prevent you from doing that now.
- bilalq 12y agoInteresting. Could this maybe be bypassed by looking at computed CSS values of an element?
- srl 12y agoApparently not. https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and_the_:visited_selector https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...
- russellsprouts 12y agoBrowsers lie in the computed CSS values. Regardless of whether you have visited the link or not, the computed style that JavaScript sees is always unvested.
- irises_come 12y agoI presumed as much. But if you can covertly jimmy the UI and parse the user's interaction, you can more or less get at the history like that anyway. I don't see any secure way to handle this besides disallowing :visited styling entirely.
- chc 12y agoI'm having a hard time following here. What is "covertly jimmying a UI" and how would it allow you to exploit visited styles?
- aligajani 12y agoI just read the source code, uses caches.
- closetnerd 12y agoHmm, clever.
- biot 12y agoHere's a related Mozilla bug report from 2002 regarding the link visited issue: https://bugzilla.mozilla.org/show_bug.cgi?id=147777 https://bugzilla.mozilla.org/show_bug.cgi?id=147777
- deleted 12y ago[deleted]
- danbruc 12y agoObvious question - how was the list of URLs compiled? Some are really specific like YouTube channels. On the other hand there are only 15 categories and there are probably a lot of people that would not get a single match or only something very generic like Wikipedia.
- yzzxy 12y agoThe coolest way would be cold, hard natural selection from Alexa top sites, possibly with weighting placed to relevant sites at the introduction of the dataset. Perhaps I will fork.
- iopq 12y agoYour interests are: Google, Facebook, Youtube, Yahoo
- pessimizer 12y agoYeah - it might be even better to subtract the most common sites, so the results are more peculiar to you.
- Conlectus 12y agoCreator here. The links were gathered by searching feedlys feed suggestions for different topics.
- tomblomfield 12y agofivethirtyeight.com appears about a dozen times for me?
- Conlectus 12y agoLinks appear multiple times if they are relevant to multiple interests. Clicks are only counted once.
- tomasien 12y agoThis just solved a huge problem I've been struggling with. This is beautiful - I don't actually want to know the information I've been trying to access, but it will make the experience better for the user. I now realize I don't HAVE to know - the browser knows, and that's all that matters. I just have to teach the browser what to do.
- jostmey 12y agoIt was eerily accurate on me. 1. science 2. technology 3. programming
- laurent123456 12y agoThey could do the same game, but hard-code the results, and be right for 95% of the audience here :)
- nikatwork 12y agoHmm, I was: 1. technology 2. programming 3. history 4. politics 5. design 6. architecture And it was dead-right.
- udayadds 12y agosame for me, though I barely read anything on history or politics
- icebraining 12y agoActually, they don't seem to diverge much. I've tried randomly clicking on grey squares on different areas and it always gave me similar results (programming, gaming, technology, engineering).
- d23 12y agoI actually was going to come to the comments, assuming they had done that before remembering that I was supposed to view the source.
- notastartup 12y agoguess I sure do love them movies from torrents. 1. technology 2. movies 3. books 4. programming 5. science 6. politics 7. gaming
- xerophtye 12y agoPretty inaccurate for me. It game minimum value to books and writing, and i love them both. I just dont open enough links about them (i read the books! Not their sites!)
- deleted 12y ago[deleted]
- mbrubeck 12y agoHere's the same exploit disguised as a game, to make it less obvious that it's tricking the user into interacting with it: http://lcamtuf.coredump.cx/yahh/ http://lcamtuf.coredump.cx/yahh/ Documentation of the game proof-of-concept: http://lcamtuf.blogspot.com/2013/05/some-harmless-old-fashioned-fun-with-css.html http://lcamtuf.blogspot.com/2013/05/some-harmless-old-fashio...
- deleted 12y ago[deleted]
- krrishd 12y agoIf you open the console and run this script, it'll click every single square, giving a list of the most common types of sites in the array being used: for(i=0;i<$$('a').length;i++) { $$('a')[i].click() }
- PurplePanda 12y agoI had to change it to start at i=1 to avoid clicking on the link to github and leaving the page
- krrishd 12y agoAh, that makes sense, I wrote and ran the script before he open sourced it.
- ben0x539 12y agoDoesn't work for me because I disabled :visited last time this sort of thing got discussed. :V
- corford 12y agoNo red squares here. Am I doing it wrong?
- vezzy-fnord 12y agoYou likely have layout.css.visited_links_enabled (or the equivalent boolean on your browser) set to false.
- mjfl 12y agoI don't have any either. I think it's because I've turned off internet history on Firefox.
- mbrutsch 12y agoYep. I took me a few minutes to figure out why it wasn't working for me...
- maerF0x0 12y agoHaha, should have been pr0n sites :P
- periferral 12y agoI am <blank>???
- Xeroday 12y agoWas on incognito and wondering why I didn't see any red squares...
- mataug 12y agoThat is, I am guessing, because there aren't any re-marketing cookies,history and other markers when you open the page in incognito
- ZoF 12y agoNo, it was because incognito tabs don't have access to browser history. This web-app's functionality is based entirely on browser history and has nothing to do with 're-marketing cookies' or other 'markers'. Not to mention that the parent commenter clearly understood this fact.
- mataug 12y agoThis is quite clever. By the way now I've got a nice list of blogs/websites that I should probably read for various topics.
- rdrey 12y agoI was also thinking of using it as a bookmarks site. :)
- amjd 12y agoThat's what I was thinking too. Here's a prettified list of the sites used: https://gist.github.com/amjd/acc5e108bfb2f29f050c https://gist.github.com/amjd/acc5e108bfb2f29f050c
- lugg 12y agoThanks so much. Been looking for an up to date blog roll like this for a while.
- zatkin 12y agoWhat's more interesting is that someone spun off Geocities and called it Neocities.
- yayitswei 12y agoHere's the original discussion on HN: https://news.ycombinator.com/item?id=5957850 https://news.ycombinator.com/item?id=5957850
- 3rd3 12y agoCouldn't one simply make a display:none on normal links and display:block on :visited, then stack them all on top each other with position:absolute and catch mouse events from each element via JS?
- heycam 12y agoBrowsers have a very limited set of properties that they allow in :visited rules, and display isn't one of them.
- deleted 12y ago[deleted]
- kimonos 12y agoCool!
- balls187 12y agoI thought the a:visited exploit was addressed.
- thegeomaster 12y agoIt was. The site can't know by itself what links are visited. It asks you to click on the visited (red) links, thereby giving it data.
- leorocky 12y agoThe browser wont let the page get at the data, that is what was fixed, but you can still show visited differently to the user, and if you make only the visited visible and get the user to interact that information is revealed.
- neoveller 12y agoI spent an unfortunate chunk of time trying to auto-click all the red square via jquery in chrome console. After a lot of reading and experimenting, I can verify that the exploit is thoroughly addressed (so far), and I cannot achieve my goal because of it :(. The most promising workaround would be to find a JS screenshot tool that doesn't rely on the DOM, and then run some client-side image analysis to get the index values of the red squares, and then go from there to click the things. Well played, exploit fixers, well played.
- ma2rten 12y agoI don't think there actually is a way to take screenshots, w/o relying on the dom.
- Geee 12y agoYou could access the webcam and zoom/enhance the reflection in the eyes to get the screenshot.
- neoveller 12y agoThink I just found a way using canvas with a semi transparent element inside of it, then overlaying that on each square, grabbing the computed/resulting color of the canvas to decipher which block is what. S O O N
- homakov 12y agoThere are much more effective tricks to use in production. You can leak user's FB token for some huge client, and you get his email/name/bio.
- mundanevoice 12y agoWao, reading my browser history while I am playing a stupid game. Elegant. :)
- Stratoscope 12y agoNot quite. See discussion above. You gave it your history by clicking the red dots and not clicking the others.
- collinjackson 12y agoHere's a paper about this technique: http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.pdf http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010....
- Conlectus 12y agoOriginal creator here. I'm super surprised to see this posted here. I can answer any questions people have.
- analog31 12y agoFor those of us who don't know Javascript, I'll just ask in broad terms: What is it, how's it work, what's it do?
- amjd 12y agoIt's a neat little hack to predict your interests among various categories. The hundreds of grey boxes that you see are actually links to sites belonging to different categories like programming, science etc. and the red ones are those that you have visited (based on your browser history). The basic idea here is of using the CSS selector a:visited to highlight visited links in red, and by clicking the red boxes the users themselves reveal the sites they have visited. The website then uses this information to draw a pretty pie chart showing which categories the user is interested in.
- xmonkee 12y agoApart from making it seem like a game, is there any reason why the user has to click the squares? Is there a way for the browser to report back which elements are currently red?
- _delirium 12y agoThat used to be possible by reading the styling in JS, but that was considered a privacy bug, since any website could slurp information from your browser history. Therefore there was an overhaul of what kind of styling could be done based on history, and what could be read back about it in JS: https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/ https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...
- dalke 12y ago
- Conlectus 12y agoOnce again, creator here. I just pushed an update that added more topics and graphs. I have had reported problems after the update. Can anyone confirm?
- Fa773NM0nK 12y agoI was in Fx Private Browsing. I spent about fifteen minutes trying to figure out why I had no red square!
- oakaz 12y agoResults are good except that I have no gaming sites in my history actually
- lrichardson 12y agoQuestion: I know that the `:visited` exploit is handled by the browsers so that you can't figure out by javascript what is going on... but what if you used just CSS to figure it out? For instance, what if you generated the CSS which had a unique image it requested via the `background-image` property, stored the data on the server, then just requested the data from the server after the fact? Do the browsers prohibit the usage of url-based css properties on CSS selectors with `:visited` or something? Does anyone have a link/reference to how the exploits were patched up?
- RussianCow 12y agoYes, they prohibit anything that might be used for this purpose.[0] So the CSS allowed for :visited selectors is limited to a small subset. [0]: https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ https://hacks.mozilla.org/2010/03/privacy-related-changes-co...
- lrichardson 12y agoGreat. Thanks for the link.
- megablast 12y agoCould your draw the screen, then save that as a screenshot, and analyse the image?
- andybak 12y agoJust what I was thinking. Can't you render the DOM to a canvas and then access the pixels in that?
- LaurentVB 12y agoApparently not: https://developer.mozilla.org/en-US/docs/Web/HTML/Canvas/Drawing_DOM_objects_into_a_canvas#Security https://developer.mozilla.org/en-US/docs/Web/HTML/Canvas/Dra... > Visited-link styles aren't applied to links rendered in SVG images, so history information can't be retrieved, and native themes aren't rendered in SVG images, which makes it harder to determine the user's platform.
- neya 12y agoThis is mind-blowing, mine was pretty accurate! I know I can view the source code, but is this/similar code available from GitHub or somewhere for us to use in our own weekend projects? (:
- dalek2point3 12y agocan someone post a screenshot of what happens once you click all the red boxes? I have too many of them and dont want to do it ...
- aps-sids 12y agoI had opened link in Private (incognito) window. #fail
- keerthiko 12y agoI could probably post a similar gizmo on HN with a results static page that says Your interests are: (some subset of) Programming Science Technology Games <random other thing: Sports, TV, childcare, etc> With literally no scripting, and everyone would find it "reasonably accurate" :D
- mdup 12y agoAt first, I thought the OP had done exactly that!
- jradd 12y agoSame thing here. I happen to be very interested in neuroscience as well, so when I read “don't forget to view source,” I assumed it would feature a bibliographic citation or something. doh…
- lugg 12y agoAlso successfully trolled. And I also thought something similar after trying to trick it a couple of times. Wasn't until I read the comments it all made sense - i was using work chrome profile none of my actual interests showed up just my professional ones.
- briancaw2 12y agofwiw, my results were very wrong
- wobbleblob 12y agoIt uses a list of sites, the ones that are in your browser history are red squares. The results may be wrong for you if you cleared your browser history, or if you share your browser with someone else, or if you habitually visit sites you don't like.
- duaneb 12y agoYes. Apparently I don't visit many programming websites, although that's mostly what I do, and I visit more gaming sites than anything. (I only play mario kart on my Wii occasionally.)
- infused 12y agoI get the same three red boxes in Chrome every time, and none in Firefox or Safari. I get three categories at the end, with no links or anything. What am I doing wrong?
- hngiszmo 12y agoIt shows you squares for a bunch of websites. Those you visited before in that browser are red. By clicking them, you tell the site that they are red, thus that you visited them. Each site belongs to a category and thus it comes to its conclusion.
- ZoF 12y agoWhat do you mean? These red boxes are links to sites you've visited in the past, they aren't showing up in Firefox or Safari because you don't have any of those sites in your browser history. This works by showing you a grid, each box represents a website, to which the creator has ascribed a category(tech/gaming/etc...) If you've visited one of those sites the box will appear red, and by clicking on the box you let the site know that it is something you've visited in the past and therefore likely one of your interests.
- asadlionpk 12y agoImprovement: You can make the gray boxes light enough (same as bg) so only Red are visible.
- Conlectus 12y agoFor anyone interested in the source, I started hosting it on GitHub at https://github.com/Conlectus/WhoAmI https://github.com/Conlectus/WhoAmI.
- zongitsrinzler 12y agoThis can be done without any user interaction (and most likely has done to you without you knowing it). Check this link for 101: https://stackoverflow.com/questions/1584850/is-it-possible-to-get-anchor-visited-state-from-javascript https://stackoverflow.com/questions/1584850/is-it-possible-t...
- pests 12y agoNote that is from 5 years ago. Modern browsers have put up defenses. Others have linked to sources throughout the thread/
- fzaninotto 12y agoHere is a white paper of another exploit without user interaction, which is still working on most browsers. It's called "Pixel-perfect timing attack". https://media.blackhat.com/us-13/US-13-Stone-Pixel-Perfect-Timing-Attacks-with-HTML5-WP.pdf https://media.blackhat.com/us-13/US-13-Stone-Pixel-Perfect-T... The related bug on the Chrome tracker was closed with a "won't fix".
- gamerDude 12y agoHahaha. I was giving it the benefit of the doubt before viewing source, and so I was wondering what happens when I push gray instead of red. :P That is probably why I got some weird interests in my results.
- enscr 12y agoIt's a shame I had only 4 red blocks. I should diversify :) Fun experiment !
- stargazer-3 12y agoOn my second try, determined to find out how it works, I drew a random smiley shape in grey box area. Painting was added to the list! Was so disappointed to find out it was a coincidence.
- KoalaOnesie 12y agoI swear to god I only clicked one link to Salon and I didn't even mean it. STOP JUDGING ME
- krat0sprakhar 12y agoIf nothing else, I did get a good list of Programming and Engineering websites :D - http://pastebin.com/zrQ7EBnP http://pastebin.com/zrQ7EBnP
- schme 12y agoThis is OT, trivial and a bit silly: How did you intend the json file? I tried with sublime but couldn't find anything to solve it. Didn't start an IDE for this.
- bombtrack 12y agoThere's several JSON formatter packages that can be installed via Package Control: cmd + shift + P, select "install package", then search for "json". I'm not sure which one I have installed, but doing cmd + shift + P in a proper context and typing "json" should give you an option for "Indent JSON" or similar. Otherwise, there's always sites like http://pro.jsonlint.com/ http://pro.jsonlint.com/
- ianamartin 12y agoI know, right? 10,000-ish ways to waste time at work.
- oeN 12y agofunny, perfect result!! and the concept is so simple, well done!
- udayadds 12y agoCan we use this for filtering hacker news articles?
- joosters 12y agoIn Firefox, you can go to about:config and set layout.css_visited_links_enabled to 'false'. This page, and others that hack the visited links styles, will no longer work.
- joshvm 12y agoNote that in Firefox only a few visual hacks will work nowadays. This means that sites can still change the local style of visited links to fit in with their colour schemes. BUT, you can't trawl someone's history by exploiting :visited any more. And also note that this will remove all :visited styling, included the usual blue->purple. Just a heads up for people changing this variable because they think their privacy is being invaded. https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ https://hacks.mozilla.org/2010/03/privacy-related-changes-co...
- Gonzih 12y agoI remember few years ago this concept was demonstrated as an way to get user website history from the browser. This is big privacy hole. And sadly nothing changed. Which is sad.
- pgl 12y agoIn a way it is, but only really through tricks like this one. Browsers can no longer access the properties of :visited, but they can affect how visited links are displayed.
- addisaden 12y agothe trick with a:visited is really awesome :D see on github: https://github.com/Conlectus/WhoAmI/blob/master/css/main.css https://github.com/Conlectus/WhoAmI/blob/master/css/main.css
- MrJagil 12y agoInteresting. At first I thought it would deduct information about me by analysing which squares I'd choose in what order and through other metrics like pacing.
- iopq 12y agopiratebay is not movies
- abritishguy 12y agoI had a very similar idea a while back, except I was measuring onAnimationFrame times with a carefully crafted CSS stylesheet to determine which links were being painted as :visited automatically and completely hidden from the user. Accuracy varied a lot between computers but in ideal circumstances (only browser running) it would have ~90% accuracy on each of 25 links I was testing against - the test took about 8 secs to run though. Interestingly it never worked particularly well in chrome - chrome seemed to stop painting :visited elements after a certain amount which prevented it from working.
- tjoff 12y agoShould explain itself better. All I get is a bunch of grey boxes (no red ones) and if I click done I get "Your interests are:"
- Conlectus 12y agoThanks for the suggestion! I made it so that it explains itself if you don't click any red boxes.
- cornholio 12y ago"Could not determine interests. (Pssst, If you did not get any red squares, try visiting without being in Private or Incognito mode)" Indeed I am unhackable.
- oneeyedpigeon 12y agoFrom the number of squares, I thought it might end up doing something even more 'clever' i.e. generate a square for each of the most recent n URLs from feeds of m news sites, then analyse, for example, words in headlines of those articles to determine what I'm interested in. Lots of potential for data analysis once you have someone's browser history.
- GUNHED_158 12y agoSome people are just too genius or protective of their privacy to enjoy this! :)
- cvburgess 12y agoThis was exactly backwards for me... maybe I read it upside down? I jest, but the concept is cool, just needs to be refined I'm sure.
- rburhum 12y agoNothing was red for me
- borkabrak 12y agoYou cleared your browser history recently?
- lurkinggrue 12y agoIt didn't work for me.
- homakov 12y agoOh also it's easy to check if you're logged in on Service1 using CSP. No user interaction, same results
- Daggett 12y agoThis is pure genius.
- Gracana 12y agoThis is really clever. One interesting use for this would be to target ads at people who visit certain sites, or to customize your site's landing page to direct visitors toward areas they might be interested in.
- HarveyW26 12y agoFail ! Order of interests I guess... technology politics gaming I HAVE NEVER GAMED ! science art psychology economics writing history programming books sports television engineering
- HarveyW26 12y agoFail ! Order of interests I guess... technology politics gaming I HAVE NEVER GAMED ! science art psychology economics writing history programming books sports television engineering
- melipone 12y agoHow are the categories obtained?
- milankragujevic 12y agoI made an automated version, check it out here: http://projects.milankragujevic.com/jspy/ http://projects.milankragujevic.com/jspy/
- deleted 12y ago[deleted]
- arkj 12y agoMaybe this link just saved my life!!! The clue for the clueless is in their forgotten yesterday.