4 ms·
Poll: Did you know about the history sniffing exploit?
Had you heard of the JavaScript history sniffing attack before it made the front page on HN?
(http://news.ycombinator.com/item?id=800693)
I'm interested to hear responses as I believe that I keep up with tech news pretty well and I had never heard of this, in my opinion, fairly serious exploit before today! Others have stated that it's old news and that everyone knows about it. I'm interested to see how the cookie crumbles (so to speak)
- profquail 17y agoI heard about this last year, when I read this article: http://www.mikeonads.com/2008/07/13/using-your-browser-url-history-estimate-gender/ http://www.mikeonads.com/2008/07/13/using-your-browser-url-h... Basically, it uses the socialhistory.js and some statistics to estimate whether you are male or female (which is useful information to advertisers). EDIT: Here's the HN story on that site: http://news.ycombinator.com/item?id=248558 http://news.ycombinator.com/item?id=248558
- aarongough 17y agoGreat link! A bit of Googling reveals that this exploit looks like it was authored by Jeremiah Grossman on August 11 2006. http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo... That seems like a very long time for an exploit so obviously useful to stay around...
- noodle 17y agoknown about it and different forms of it for a while. i wouldn't really call it an exploit in and of itself, though, as you can pull the information out of the css :visited pseudoclass in a variety of ways. i'd call it an unintended consequence.
- aarongough 17y agoFair enough, an unintended consequence with a plethora of uses for the evil and not-so-evil alike though... I feel like a little bit of a failure at the moment! My only solace is that I wasn't active in the web-development (or software at all) industry when the 'exploit' was released to the wild. I guess you can't catch everything!
- noodle 17y agoyou'd have to go back to html 3.0 in 1997 when the vlink property was introduced to the body tag. that would be the origin of being able to specifically color links you've visited, allowing you to set a bizarre color to visited links and let javascript traverse the dom to find links that are colored weirdly.
- aarongough 17y agoI wasn't anywhere near the industry by that point. I got my professional start in 2002... Long enough to remember the 'bad old days' though!
- chaosprophet 17y agoI've known about it since I encountered javascript.history.back(). I figured if js could find out my last page, then it could probably read my entire history. Since then my browser does not have any history saved. Edit: I've never really thought of it as an exploit though.
- aarongough 17y agoYou understand that it's an exploit that takes advantage of the browser's CSS :visited pseudoclass right? The JavaScript history object is specifically designed not to give 3rd parties access to your history info...
- aarongough 17y agoHaha, there's no shame in answering 'No' people! I'll admit I did (and so far I'm the only one!)... I know the HN crowd are way more aware about issues like this than the average person, but to have your fingers this firmly on the pulse of the 'net? Impressive? EDIT: Now I'm not the only one. Misery loves company! Thanks :-p