3 ms·

I presumed as much. But if you can covertly jimmy the UI and parse the user's interaction, you can more or less get at the history like that anyway. I don't se

I presumed as much. But if you can covertly jimmy the UI and parse the user's interaction, you can more or less get at the history like that anyway. I don't see any secure way to handle this besides disallowing :visited styling entirely.

chc 12y ago
I'm having a hard time following here. What is "covertly jimmying a UI" and how would it allow you to exploit visited styles?
- gburt 12y ago
  For a less "covert" example than I am sure the OP was thinking, you could have "click the red button to continue" sort of like this page does. :)
  - eli 12y ago
    Wouldn't that also require a hundred same sized differently colored buttons, just like this site?
    - grimmfang 12y ago
      You could prompt the user through multiple pages of "questioning" under a similar premise of psychological analysis, or some other manipulation. This would reduce the number of buttons per page. That's what I think he meant.
    - btgeekboy 12y ago
      Not necessarily. What if the un-visited box was set to display:none? That would leave you with just the visited boxes showing. Now make it even less obvious: create a false box with the proper :visited color. That's your bottom layer, your fallthrough if the user hasn't visited any of them. Now position all of the :visited boxes as exactly the same size and position over that bottom layer. Now, when the user clicks the button to continue, they're guaranteed to click either your fallthrough ("user has none of my sites") or one of those you are monitoring for. The end result of all this is a page that says "Click the box to continue."
      - praptak 12y ago
        > Not necessarily. What if the un-visited box was set to display:none? Then it would remain 'none' for the visited box too. Messing with 'display' is disabled in 'visited' to prevent this class of workarounds.
      - deleted 12y ago
        [deleted]
SahAssar 12y ago
It's surprisingly hard to do. Since the allowed styling does not affect positioning in any way (you used to be able to change the font-weight, but not anymore) and the browser removes all :visited styling for client side html-image libraries such as html2canvas you need to generate a massive amount of clicks from the user or have them targeted only to visited elements such as this page does.

chc 12y ago

I'm having a hard time following here. What is "covertly jimmying a UI" and how would it allow you to exploit visited styles?

gburt 12y ago
For a less "covert" example than I am sure the OP was thinking, you could have "click the red button to continue" sort of like this page does. :)
- eli 12y ago
  Wouldn't that also require a hundred same sized differently colored buttons, just like this site?
  - grimmfang 12y ago
    You could prompt the user through multiple pages of "questioning" under a similar premise of psychological analysis, or some other manipulation. This would reduce the number of buttons per page. That's what I think he meant.
  - btgeekboy 12y ago
    Not necessarily. What if the un-visited box was set to display:none? That would leave you with just the visited boxes showing. Now make it even less obvious: create a false box with the proper :visited color. That's your bottom layer, your fallthrough if the user hasn't visited any of them. Now position all of the :visited boxes as exactly the same size and position over that bottom layer. Now, when the user clicks the button to continue, they're guaranteed to click either your fallthrough ("user has none of my sites") or one of those you are monitoring for. The end result of all this is a page that says "Click the box to continue."
    - praptak 12y ago
      > Not necessarily. What if the un-visited box was set to display:none? Then it would remain 'none' for the visited box too. Messing with 'display' is disabled in 'visited' to prevent this class of workarounds.
    - deleted 12y ago
      [deleted]

SahAssar 12y ago

It's surprisingly hard to do. Since the allowed styling does not affect positioning in any way (you used to be able to change the font-weight, but not anymore) and the browser removes all :visited styling for client side html-image libraries such as html2canvas you need to generate a massive amount of clicks from the user or have them targeted only to visited elements such as this page does.