4 ms·

Question: I know that the `:visited` exploit is handled by the browsers so that you can't figure out by javascript what is going on... but what if you used ju

Question: I know that the `:visited` exploit is handled by the browsers so that you can't figure out by javascript what is going on... but what if you used just CSS to figure it out? For instance, what if you generated the CSS which had a unique image it requested via the `background-image` property, stored the data on the server, then just requested the data from the server after the fact? Do the browsers prohibit the usage of url-based css properties on CSS selectors with `:visited` or something? Does anyone have a link/reference to how the exploits were patched up?

RussianCow 12y ago
Yes, they prohibit anything that might be used for this purpose.[0] So the CSS allowed for :visited selectors is limited to a small subset. [0]: https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ https://hacks.mozilla.org/2010/03/privacy-related-changes-co...
- lrichardson 12y ago
  Great. Thanks for the link.
megablast 12y ago
Could your draw the screen, then save that as a screenshot, and analyse the image?
- andybak 12y ago
  Just what I was thinking. Can't you render the DOM to a canvas and then access the pixels in that?
  - LaurentVB 12y ago
    Apparently not: https://developer.mozilla.org/en-US/docs/Web/HTML/Canvas/Drawing_DOM_objects_into_a_canvas#Security https://developer.mozilla.org/en-US/docs/Web/HTML/Canvas/Dra... > Visited-link styles aren't applied to links rendered in SVG images, so history information can't be retrieved, and native themes aren't rendered in SVG images, which makes it harder to determine the user's platform.
    - Cthulhu_ 12y ago
      They thought of everything, :)