6 ms·
History theft with CSS Boolean algebra
- heydenberk 12y agoThere are a bunch of these exploits — I remember one a few weeks ago that posed as a mind-reading survey — and I think they can only be well and truly solved by a same-domain policy for :visited links. In short, don't apply :visited styling to a link unless that link is the same domain as the host page. This is the general security model on the rest of the web and it'd work here.
- gertef 12y agoSadly that removes most of the user-helping functionality of the :visited class.
- nfoz 12y agoAlternatively, we could keep :visited, and remove most of the expressive power of css/javascript that allow these exploits to exist. It would be like time-travelling back to the mid-90s, when visited-link-coloration was invented!
- baddox 12y agoThe minimal "expressive power" required to pull off the simplest exploit is just a way to capture click events. That would be quite restrictive indeed.
- baddox 12y agoYeah, I like being able to tell if I've already read, say, a Wikipedia article that is linked from some random blog article.
- pornel 12y agoor better, have separate visited database per origin (i.e. rather than tracking state of `url` track state of `(url, origin)` tuples). This way e.g. links visited from HN would be marked as visited on HN and on HN only. It wouldn't disclose any information the site can't already get by tracking clicks.
- gavinpc 12y agoHow does this differ from "a same-domain policy for :visited links"?
- sejje 12y agoBecause it wouldn't mark the links on the HN front page as visited if it were a "same-domain policy." The origin policy fixes that.
- deleted 12y ago[deleted]
- TheCoreh 12y agoThis is an amazing idea. Would allow the entire flexibility without having to whitelist specific styles, and close 100% of the information leaks.
- baddox 12y agoIt still removes a large part of the utility of the feature. I want to be able to see if I've visited a link, even if that link is on some random blog that I've never visited before.
- Aldo_MX 12y agohttp://domain.com/tracker?url=http%3A%2F%2Fwebsite-you-visited.com http://domain.com/tracker?url=http%3A%2F%2Fwebsite-you-visit... Oops, sorry, my tracker removed the feature for you, I feel really ashamed :(...
- coldtea 12y agoI call BS. This only "removed the feature" for sites that use such trackers -- the feature still works on 99% of the web. So even what you said is not like the grand-parent's proposal that removes the functionality totally.
- 12y ago
- userbinator 12y agoI think better for the user might be "apply the right styling, but don't tell scripts." This is orthogonal to letting same-domain links have more information on their visited status too.
- BrandonLive 12y agoIsn't the point of this that the script code doesn't need access to anything via getComputedStyle? It's the user telling the script what color something is.
- epmatsw 12y agoOh neat, I thought this was broken at first since it said that I hadn't visited news.ycombinator.com. Then I remembered that after seeing a similar (though less clever) exploit a few weeks ago, I'd changed Firefox to not show visited styles. I'd call that a success.
- deleted 12y ago[deleted]
- thegeomaster 12y agoConsidering the work needed by the website to convince the user to give away the data, and even with approaches like described with the article, we may be overestimating what websites could learn of us by checking if we've visited some random 2, or 4, or 15 sites. Yes, it's an invasion of privacy and has to be sanitized, but it's not like that websites can see all of your history, view it in chronological order, or know if you've visited this link 6 months ago or today. And plus, you need to make the user somehow disclose what he sees on the screen, which may often look suspicious. And what would an adversarial website do with these {visitedlinks, IP} tuples? Hit me with personalized ads or sell that modicum of my history to some ad company? Big shit, I hit the reset button on my router, and I get a new dynamic IP address from the ISP. The site now knows nothing. These work more as proof-of-concepts. The inconvenience they require to be collected, paired with the limited utility of the results, makes for an unattractive attack vector. I agree that if someone wants to target specifically you and knows something about you, they can put this class of exploits to a more threatening use, such as (if you're at work) seeing if you've visited some company LAN URL. Or perhaps they can see if you've accessed the admin pages on some website they're targeting, so they can determine if you have admin rights there.
- f- 12y agoWell, say... http://www.theregister.co.uk/2010/12/03/browser_history_sniffing/ http://www.theregister.co.uk/2010/12/03/browser_history_snif...
- thegeomaster 12y agoOh, now YouPorn knows I've been visiting PornHub too. So much valuable info! Too bad I use them both just to look at chicks being banged. Seriously though, I'd like to see what the other 45 websites are and what they do, but the PDF linked 404's. And I reckon this is the getComputedStyle approach, and that was, AFAIK, fixed. The new ways of exploiting the styled :visited links are going to require more work.
- f- 12y agoI don't know why they wanted the info (and it was fairly dumb of them to try). Nevertheless, they saw some practical value in it, so did others.
- erikano 12y ago>[...] for those using non-WebKit browsers, here's a slightly modified version that will do the trick for you [...] All four are grey in Firefox for Android.
- rockdoe 12y agoSame in desktop Firefox. Does the attack not work against Firefox or did he mess up the CSS?
- tripzilch 12y agoI'm assuming he just didn't thoroughly test the Firefox version of this exploit. In theory it can be made to work, the browser has to have some kind of rounding mode for opacity. It could be solved by making the up/down rounding random.
- tripzilch 12y agoWow. Lcamtuf is such a king of side-channel attacks. Using opacity quantization/rounding errors to get around CSS :visited restrictions ... crazy brilliant.