5 ms·

I thought the a:visited exploit was addressed.

thegeomaster 12y ago
It was. The site can't know by itself what links are visited. It asks you to click on the visited (red) links, thereby giving it data.
leorocky 12y ago
The browser wont let the page get at the data, that is what was fixed, but you can still show visited differently to the user, and if you make only the visited visible and get the user to interact that information is revealed.
neoveller 12y ago
I spent an unfortunate chunk of time trying to auto-click all the red square via jquery in chrome console. After a lot of reading and experimenting, I can verify that the exploit is thoroughly addressed (so far), and I cannot achieve my goal because of it :(. The most promising workaround would be to find a JS screenshot tool that doesn't rely on the DOM, and then run some client-side image analysis to get the index values of the red squares, and then go from there to click the things. Well played, exploit fixers, well played.
- ma2rten 12y ago
  I don't think there actually is a way to take screenshots, w/o relying on the dom.
- Geee 12y ago
  You could access the webcam and zoom/enhance the reflection in the eyes to get the screenshot.
  - neoveller 12y ago
    Think I just found a way using canvas with a semi transparent element inside of it, then overlaying that on each square, grabbing the computed/resulting color of the canvas to decipher which block is what. S O O N
    - path411 12y ago
      I tried doing this: http://jsfiddle.net/path411/sRkWq/ http://jsfiddle.net/path411/sRkWq/ It appears as though Chrome (37-dev) will not receive any data from behind the canvas, while IE11 and FF(29) will allow me to see pixels behind the canvas, but only see the unvisited color. I don't believe there is another method to receive the color of a pixel from a canvas except through getImageData(), but I could be wrong.
cynwoody 12y ago
That's why you have to click. Before the a:visited exploit was patched, a simple loop with GetComputedStyle would have sufficed. If you do that in a modern browser, all the squares come back color gray. The content script only gets to see the style attributes as they would be in the unvisited state.

It was. The site can't know by itself what links are visited. It asks you to click on the visited (red) links, thereby giving it data.

leorocky 12y ago

The browser wont let the page get at the data, that is what was fixed, but you can still show visited differently to the user, and if you make only the visited visible and get the user to interact that information is revealed.

neoveller 12y ago

I spent an unfortunate chunk of time trying to auto-click all the red square via jquery in chrome console. After a lot of reading and experimenting, I can verify that the exploit is thoroughly addressed (so far), and I cannot achieve my goal because of it :(. The most promising workaround would be to find a JS screenshot tool that doesn't rely on the DOM, and then run some client-side image analysis to get the index values of the red squares, and then go from there to click the things. Well played, exploit fixers, well played.

ma2rten 12y ago
I don't think there actually is a way to take screenshots, w/o relying on the dom.
Geee 12y ago
You could access the webcam and zoom/enhance the reflection in the eyes to get the screenshot.
- neoveller 12y ago
  Think I just found a way using canvas with a semi transparent element inside of it, then overlaying that on each square, grabbing the computed/resulting color of the canvas to decipher which block is what. S O O N
  - path411 12y ago
    I tried doing this: http://jsfiddle.net/path411/sRkWq/ http://jsfiddle.net/path411/sRkWq/ It appears as though Chrome (37-dev) will not receive any data from behind the canvas, while IE11 and FF(29) will allow me to see pixels behind the canvas, but only see the unvisited color. I don't believe there is another method to receive the color of a pixel from a canvas except through getImageData(), but I could be wrong.

cynwoody 12y ago

That's why you have to click. Before the a:visited exploit was patched, a simple loop with GetComputedStyle would have sufficed. If you do that in a modern browser, all the squares come back color gray. The content script only gets to see the style attributes as they would be in the unvisited state.