4 ms·

There are a bunch of these exploits — I remember one a few weeks ago that posed as a mind-reading survey — and I think they can only be well and truly solved by

There are a bunch of these exploits — I remember one a few weeks ago that posed as a mind-reading survey — and I think they can only be well and truly solved by a same-domain policy for :visited links. In short, don't apply :visited styling to a link unless that link is the same domain as the host page. This is the general security model on the rest of the web and it'd work here.

gertef 12y ago
Sadly that removes most of the user-helping functionality of the :visited class.
- nfoz 12y ago
  Alternatively, we could keep :visited, and remove most of the expressive power of css/javascript that allow these exploits to exist. It would be like time-travelling back to the mid-90s, when visited-link-coloration was invented!
  - baddox 12y ago
    The minimal "expressive power" required to pull off the simplest exploit is just a way to capture click events. That would be quite restrictive indeed.
- baddox 12y ago
  Yeah, I like being able to tell if I've already read, say, a Wikipedia article that is linked from some random blog article.
pornel 12y ago
or better, have separate visited database per origin (i.e. rather than tracking state of `url` track state of `(url, origin)` tuples). This way e.g. links visited from HN would be marked as visited on HN and on HN only. It wouldn't disclose any information the site can't already get by tracking clicks.
- gavinpc 12y ago
  How does this differ from "a same-domain policy for :visited links"?
  - sejje 12y ago
    Because it wouldn't mark the links on the HN front page as visited if it were a "same-domain policy." The origin policy fixes that.
  - deleted 12y ago
    [deleted]
- TheCoreh 12y ago
  This is an amazing idea. Would allow the entire flexibility without having to whitelist specific styles, and close 100% of the information leaks.
- baddox 12y ago
  It still removes a large part of the utility of the feature. I want to be able to see if I've visited a link, even if that link is on some random blog that I've never visited before.
  - Aldo_MX 12y ago
    http://domain.com/tracker?url=http%3A%2F%2Fwebsite-you-visited.com http://domain.com/tracker?url=http%3A%2F%2Fwebsite-you-visit... Oops, sorry, my tracker removed the feature for you, I feel really ashamed :(...
    - coldtea 12y ago
      I call BS. This only "removed the feature" for sites that use such trackers -- the feature still works on 99% of the web. So even what you said is not like the grand-parent's proposal that removes the functionality totally.
      - 12y ago
userbinator 12y ago
I think better for the user might be "apply the right styling, but don't tell scripts." This is orthogonal to letting same-domain links have more information on their visited status too.
- BrandonLive 12y ago
  Isn't the point of this that the script code doesn't need access to anything via getComputedStyle? It's the user telling the script what color something is.

gertef 12y ago

Sadly that removes most of the user-helping functionality of the :visited class.

nfoz 12y ago
Alternatively, we could keep :visited, and remove most of the expressive power of css/javascript that allow these exploits to exist. It would be like time-travelling back to the mid-90s, when visited-link-coloration was invented!
- baddox 12y ago
  The minimal "expressive power" required to pull off the simplest exploit is just a way to capture click events. That would be quite restrictive indeed.
baddox 12y ago
Yeah, I like being able to tell if I've already read, say, a Wikipedia article that is linked from some random blog article.

pornel 12y ago

or better, have separate visited database per origin (i.e. rather than tracking state of `url` track state of `(url, origin)` tuples). This way e.g. links visited from HN would be marked as visited on HN and on HN only. It wouldn't disclose any information the site can't already get by tracking clicks.

gavinpc 12y ago
How does this differ from "a same-domain policy for :visited links"?
- sejje 12y ago
  Because it wouldn't mark the links on the HN front page as visited if it were a "same-domain policy." The origin policy fixes that.
- deleted 12y ago
  [deleted]
TheCoreh 12y ago
This is an amazing idea. Would allow the entire flexibility without having to whitelist specific styles, and close 100% of the information leaks.
baddox 12y ago
It still removes a large part of the utility of the feature. I want to be able to see if I've visited a link, even if that link is on some random blog that I've never visited before.
- Aldo_MX 12y ago
  http://domain.com/tracker?url=http%3A%2F%2Fwebsite-you-visited.com http://domain.com/tracker?url=http%3A%2F%2Fwebsite-you-visit... Oops, sorry, my tracker removed the feature for you, I feel really ashamed :(...
  - coldtea 12y ago
    I call BS. This only "removed the feature" for sites that use such trackers -- the feature still works on 99% of the web. So even what you said is not like the grand-parent's proposal that removes the functionality totally.
    - 12y ago

userbinator 12y ago

I think better for the user might be "apply the right styling, but don't tell scripts." This is orthogonal to letting same-domain links have more information on their visited status too.

BrandonLive 12y ago
Isn't the point of this that the script code doesn't need access to anything via getComputedStyle? It's the user telling the script what color something is.