6 ms·

Show HN: Tricking the user to access history using CSS and captchas

140 points by frantzmiccoli 12y ago

thinkbohemian 12y ago
s/his/their Unless of course there is something on this service that actually limits all of your users into being one gender :)
- aroch 12y ago
  The "male" pronoun's use is grammatically correct when the gender of the subject is unknown. Take your SJW puffery to Tumblr.
  - deleted 12y ago
    [deleted]
  - brenschluss 12y ago
    Incorrect. Grammar, like all aspects of language, are socially generated. Currently, the shift has been to move towards 'she' or 'they' as a default gender. Saying "'he' is grammatically correct" is like saying "C++ is the proper programming language." It's all about usage.
    - mikeash 12y ago
      And "he" as a gender-neutral pronoun is still quite common usage, thus still correct by your definition of it.
  - comrh 12y ago
    You don't have to be a jerk about it.
  - cfqycwz 12y ago
    It is true that the use of male pronouns in gender-neutral context has historically been considered correct and is still considered correct by many. It is, however, generally discouraged because it only serves to reinforce the very real and problematic implication of male as the "default" sex.
    - okasaki 12y ago
      Discouraged by whom?
      - hyperpape 12y ago
        It's a fairly common prescription in style guides, though it is still debated: try Googling "style guides gender neutral language" for instance.
  - dang 12y ago
    > Take your SJW puffery to Tumblr Personal attacks are not allowed on Hacker News. Please don't address other users like this. (My comment here has nothing to do with pronouns.)
  - hyperpape 12y ago
    How is this anything but a non-sequitur? Personal attacks aren't ungrammatical and racial slurs aren't ungrammatical. Yelling "FIRST!" at the top of a comment thread probably isn't ungrammatical either. Like using 'he' for a generic user, each behavior is obnoxious (albeit in different ways and with different scales). Singular they is well established as a grammatical construction (http://www.crossmyt.com/hc/linghebr/sgtheirl.html http://www.crossmyt.com/hc/linghebr/sgtheirl.html, for instance), and avoids the issue entirely.
- Nickoladze 12y ago
  http://en.wikipedia.org/wiki/Gender-specific_and_gender-neutral_pronouns#Generic_he http://en.wikipedia.org/wiki/Gender-specific_and_gender-neut...
  - zacharydanger 12y ago
    1745 called. They want their grammar back. http://en.wikipedia.org/wiki/Singular_they http://en.wikipedia.org/wiki/Singular_they
  - dethstar 12y ago
    https://en.wikipedia.org/wiki/Gender-specific_and_gender-neutral_pronouns#Alternatives_to_generic_he https://en.wikipedia.org/wiki/Gender-specific_and_gender-neu...
- octagonal 12y ago
  :%s/his/their/g sorry.
  - owenversteeg 12y ago
    There was only one "his" in the title, it didn't need to be a global replace.
jere 12y ago
Quite scarier than the TinSnail demo, but it must have a much lower bandwidth. The source only has three links and you will probably see all three if you have caching turned on. I guess if you're looking for one or two specific sites, it doesn't matter.
CheckHook 12y ago
Interesting but this method is limited to the URLs that you list in the javascript (in this case linklist.js). More of a specific validation to see if the user has visited the links you provide rather than a total data scrape. To full scrape the users history you would have to list every URL in existence. Great proof of concept though.
- frantzmiccoli 12y ago
  Rebuilding the full user history would be impossible, but finding a few compromising websites would be easy.
- jengamaster 12y ago
  Would have been a greater one if linklist.js contained links to more sites than Github, Reddit and Hackernews... I mean I could have guessed those by assuming that I visited that page via Hackernews.
  - frantzmiccoli 12y ago
    My point was to actually show something to the testers, I reduced the scope on purpose.
- mikeash 12y ago
  There are a lot of attacks like this, and it's serious enough that browsers attempt to mitigate them by e.g. preventing JavaScript from reading out the computed properties of a visited link element. Three sites is obviously too small to do much, but if you splat in a list bigger list of popular web sites you can learn a lot about your visitors.
- cissou 12y ago
  For ad related purposes, it makes it easy to see if you've visited competitors' websites (3-5 of them), therefore meaning that you're actively looking for business, instead of just bouncing on the page with no intent of buying anything.
NathanKP 12y ago
Very nice concept. You should also add the following CSS to the captcha letters: -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; This will make it feel even more like a real captcha by making it impossible to select the text. (Right now you can select it to see the invisible letters)
- frantzmiccoli 12y ago
  Done, thanks for the hint ;)
  - mzs 12y ago
    I can still select text with mouse in ff 24.5 esr - but still very clever trick!
    - frantzmiccoli 12y ago
      I didn't applied the style to the right element... My bad!
      - mzs 12y ago
        Works now, but you might want to block pointer events too, for example I can drag with the mouse from the captcha into the text area below to get a URL.
- bennettfeely 12y ago
  Alternatively, pointer-events: none; will do all the above in one property. Better cross-browser support also.
cissou 12y ago
Brilliant. getComputedStyle used to give away the color of a link, so at some time this attack was trivial: you didn't need any user input, as a blue link meant :unvisited, and a purple one meant :visited. Replacing getComputedStyle with user input ("is this letter black or transparent?") is definitely brilliant.
- aaronm67 12y ago
  There was a pretty interesting talk about using differences in style render time to get history. https://www.youtube.com/watch?v=KcOQfYlyIqw https://www.youtube.com/watch?v=KcOQfYlyIqw It's pretty interesting, and can be done in a way that doesn't require any user input.
ultimatedelman 12y ago
What am I missing? I just got this pre-determined list of links: https://github.com/frantzmiccoli/visited-captcha-history/blob/master/js/linkslist.js https://github.com/frantzmiccoli/visited-captcha-history/blo... I was impressed when this list came up, but suspicious because I hadn't visited reddit or github yet today.
- gkoberger 12y ago
  It's site's you've visited at any time in the past (since the cache was cleared). Anything that would normally show up as purple rather than blue on regular websites.
- yournemesis 12y ago
  I took me a minute to figure out, but that hard coded list is the list of URLs it checks to see if you've visited. Try opening a private browser window.
dang 12y ago
The submitted title was "Show HN: Tricking the user to access his history using CSS and captchas". We finessed the pronoun issue in this case by just taking "his" out.
- frantzmiccoli 12y ago
  I'm impressed by the number of comments this can raise. Your solution seems like a good one, if only I could edit the title.
nej 12y ago
Clever
deleted 12y ago
[deleted]
linshunghuang 12y ago
You might want to check out the research paper "I Still Know What You Visited Last Summer Leaking browsing history via user interaction and side channel attacks" ( http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.pdf http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.... ). The paper describes several similar (if not the same) attacks.
- kedean 12y ago
  Another interesting, more recent paper (I couldn't find a link to the actual pdf, but I'm sure people are resourceful): http://dl.acm.org/citation.cfm?id=2516712 http://dl.acm.org/citation.cfm?id=2516712 This one describes an attack to not only steal browser history, but to reconstruct pages from the users cache.
mikelat 12y ago
That's impressive. Honestly modern browsers should just start ignoring off-domain :visted styles.
- spb 12y ago
  That would break aggregator sites like HN and Reddit (although really they should really be maintaining the visit history themselves, as they do with Reddit Gold users).
  - adrr 12y ago
    You could to do opt in permissions similar to the permission request for location information or for chrome desktop notifications.
  - endianswap 12y ago
    I tried to use the history tracking that comes with Reddit Gold for about a week and it was virtually useless. After browsing on my phone and two computers only like 1 in 10 of the links would correctly show up as purple on the other devices (even just PC to PC it didn't work). Edit: I should mention I bought Reddit Gold just for this feature, so I was optimistic that it'd work.
    - tokenizerrr 12y ago
      As an alternative, you can set reddit to hide links that you have voted upon which does not require a reddit gold account.
  - mschuster91 12y ago
    > although really they should really be maintaining the visit history themselves, as they do with Reddit Gold users Another HTTP request between me and the content I want. Another 1s of RTT (UMTS link)... No.
    - DavidSJ 12y ago
      This can be done in parallel with JS, without using an HTTP redirect.

140 points by frantzmiccoli 12y ago

s/his/their Unless of course there is something on this service that actually limits all of your users into being one gender :)

aroch 12y ago
The "male" pronoun's use is grammatically correct when the gender of the subject is unknown. Take your SJW puffery to Tumblr.
- deleted 12y ago
  [deleted]
- brenschluss 12y ago
  Incorrect. Grammar, like all aspects of language, are socially generated. Currently, the shift has been to move towards 'she' or 'they' as a default gender. Saying "'he' is grammatically correct" is like saying "C++ is the proper programming language." It's all about usage.
  - mikeash 12y ago
    And "he" as a gender-neutral pronoun is still quite common usage, thus still correct by your definition of it.
- comrh 12y ago
  You don't have to be a jerk about it.
- cfqycwz 12y ago
  It is true that the use of male pronouns in gender-neutral context has historically been considered correct and is still considered correct by many. It is, however, generally discouraged because it only serves to reinforce the very real and problematic implication of male as the "default" sex.
  - okasaki 12y ago
    Discouraged by whom?
    - hyperpape 12y ago
      It's a fairly common prescription in style guides, though it is still debated: try Googling "style guides gender neutral language" for instance.
- dang 12y ago
  > Take your SJW puffery to Tumblr Personal attacks are not allowed on Hacker News. Please don't address other users like this. (My comment here has nothing to do with pronouns.)
- hyperpape 12y ago
  How is this anything but a non-sequitur? Personal attacks aren't ungrammatical and racial slurs aren't ungrammatical. Yelling "FIRST!" at the top of a comment thread probably isn't ungrammatical either. Like using 'he' for a generic user, each behavior is obnoxious (albeit in different ways and with different scales). Singular they is well established as a grammatical construction (http://www.crossmyt.com/hc/linghebr/sgtheirl.html http://www.crossmyt.com/hc/linghebr/sgtheirl.html, for instance), and avoids the issue entirely.
Nickoladze 12y ago
http://en.wikipedia.org/wiki/Gender-specific_and_gender-neutral_pronouns#Generic_he http://en.wikipedia.org/wiki/Gender-specific_and_gender-neut...
- zacharydanger 12y ago
  1745 called. They want their grammar back. http://en.wikipedia.org/wiki/Singular_they http://en.wikipedia.org/wiki/Singular_they
- dethstar 12y ago
  https://en.wikipedia.org/wiki/Gender-specific_and_gender-neutral_pronouns#Alternatives_to_generic_he https://en.wikipedia.org/wiki/Gender-specific_and_gender-neu...
octagonal 12y ago
:%s/his/their/g sorry.
- owenversteeg 12y ago
  There was only one "his" in the title, it didn't need to be a global replace.

jere 12y ago

Quite scarier than the TinSnail demo, but it must have a much lower bandwidth. The source only has three links and you will probably see all three if you have caching turned on. I guess if you're looking for one or two specific sites, it doesn't matter.

CheckHook 12y ago

Interesting but this method is limited to the URLs that you list in the javascript (in this case linklist.js). More of a specific validation to see if the user has visited the links you provide rather than a total data scrape. To full scrape the users history you would have to list every URL in existence. Great proof of concept though.

frantzmiccoli 12y ago
Rebuilding the full user history would be impossible, but finding a few compromising websites would be easy.
jengamaster 12y ago
Would have been a greater one if linklist.js contained links to more sites than Github, Reddit and Hackernews... I mean I could have guessed those by assuming that I visited that page via Hackernews.
- frantzmiccoli 12y ago
  My point was to actually show something to the testers, I reduced the scope on purpose.
mikeash 12y ago
There are a lot of attacks like this, and it's serious enough that browsers attempt to mitigate them by e.g. preventing JavaScript from reading out the computed properties of a visited link element. Three sites is obviously too small to do much, but if you splat in a list bigger list of popular web sites you can learn a lot about your visitors.
cissou 12y ago
For ad related purposes, it makes it easy to see if you've visited competitors' websites (3-5 of them), therefore meaning that you're actively looking for business, instead of just bouncing on the page with no intent of buying anything.

NathanKP 12y ago

Very nice concept. You should also add the following CSS to the captcha letters: -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; This will make it feel even more like a real captcha by making it impossible to select the text. (Right now you can select it to see the invisible letters)

frantzmiccoli 12y ago
Done, thanks for the hint ;)
- mzs 12y ago
  I can still select text with mouse in ff 24.5 esr - but still very clever trick!
  - frantzmiccoli 12y ago
    I didn't applied the style to the right element... My bad!
    - mzs 12y ago
      Works now, but you might want to block pointer events too, for example I can drag with the mouse from the captcha into the text area below to get a URL.
bennettfeely 12y ago
Alternatively, pointer-events: none; will do all the above in one property. Better cross-browser support also.

cissou 12y ago

Brilliant. getComputedStyle used to give away the color of a link, so at some time this attack was trivial: you didn't need any user input, as a blue link meant :unvisited, and a purple one meant :visited. Replacing getComputedStyle with user input ("is this letter black or transparent?") is definitely brilliant.

aaronm67 12y ago
There was a pretty interesting talk about using differences in style render time to get history. https://www.youtube.com/watch?v=KcOQfYlyIqw https://www.youtube.com/watch?v=KcOQfYlyIqw It's pretty interesting, and can be done in a way that doesn't require any user input.

ultimatedelman 12y ago

What am I missing? I just got this pre-determined list of links: https://github.com/frantzmiccoli/visited-captcha-history/blob/master/js/linkslist.js https://github.com/frantzmiccoli/visited-captcha-history/blo... I was impressed when this list came up, but suspicious because I hadn't visited reddit or github yet today.

gkoberger 12y ago
It's site's you've visited at any time in the past (since the cache was cleared). Anything that would normally show up as purple rather than blue on regular websites.
yournemesis 12y ago
I took me a minute to figure out, but that hard coded list is the list of URLs it checks to see if you've visited. Try opening a private browser window.

dang 12y ago

The submitted title was "Show HN: Tricking the user to access his history using CSS and captchas". We finessed the pronoun issue in this case by just taking "his" out.

frantzmiccoli 12y ago
I'm impressed by the number of comments this can raise. Your solution seems like a good one, if only I could edit the title.

nej 12y ago

Clever

deleted 12y ago

[deleted]

linshunghuang 12y ago

You might want to check out the research paper "I Still Know What You Visited Last Summer Leaking browsing history via user interaction and side channel attacks" ( http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.pdf http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.... ). The paper describes several similar (if not the same) attacks.

kedean 12y ago
Another interesting, more recent paper (I couldn't find a link to the actual pdf, but I'm sure people are resourceful): http://dl.acm.org/citation.cfm?id=2516712 http://dl.acm.org/citation.cfm?id=2516712 This one describes an attack to not only steal browser history, but to reconstruct pages from the users cache.

mikelat 12y ago

That's impressive. Honestly modern browsers should just start ignoring off-domain :visted styles.

spb 12y ago
That would break aggregator sites like HN and Reddit (although really they should really be maintaining the visit history themselves, as they do with Reddit Gold users).
- adrr 12y ago
  You could to do opt in permissions similar to the permission request for location information or for chrome desktop notifications.
- endianswap 12y ago
  I tried to use the history tracking that comes with Reddit Gold for about a week and it was virtually useless. After browsing on my phone and two computers only like 1 in 10 of the links would correctly show up as purple on the other devices (even just PC to PC it didn't work). Edit: I should mention I bought Reddit Gold just for this feature, so I was optimistic that it'd work.
  - tokenizerrr 12y ago
    As an alternative, you can set reddit to hide links that you have voted upon which does not require a reddit gold account.
- mschuster91 12y ago
  > although really they should really be maintaining the visit history themselves, as they do with Reddit Gold users Another HTTP request between me and the content I want. Another 1s of RTT (UMTS link)... No.
  - DavidSJ 12y ago
    This can be done in parallel with JS, without using an HTTP redirect.