3 ms·
Unfortunately, this is just really old news and really lame. Man, I hate using the word lame. Its not an "attack". Its simply taking advantage of a feature buil
by geuis 17y ago
Unfortunately, this is just really old news and really lame. Man, I hate using the word lame. Its not an "attack". Its simply taking advantage of a feature built into all browsers since like 2000 or before.
- timf 17y agoIt is old news, but CSS history 'browsing' can be used as an attack to find authz tokens in certain URLs.
- dfranke 17y agoIt's old and it's somewhat lame, but it is an attack. CSS and the DOM were designed not to allow this sort of information leak. They missed a spot.
- ubernostrum 17y agoThe problem, of course, is how to solve this without neutering both CSS and the DOM in the process.
- taitems 17y agoMaybe :visited should not apply to cross domain links.
- mildweed 17y agoThis is now the 5th time this topic has been posted to HN. May 2008 was when it all started: http://www.azarask.in/blog/post/socialhistoryjs/ http://www.azarask.in/blog/post/socialhistoryjs/ http://news.ycombinator.com/item?id=248558 http://news.ycombinator.com/item?id=248558 http://news.ycombinator.com/item?id=404564 http://news.ycombinator.com/item?id=404564 http://news.ycombinator.com/item?id=617546 http://news.ycombinator.com/item?id=617546 http://news.ycombinator.com/item?id=717802 http://news.ycombinator.com/item?id=717802
- marchewa 17y agoThat's true -- there have been several projects making use of the CSS :visited history sniffing technique. The method itself was originally reported in early 2000. See http://whattheinternetknowsaboutyou.com/docs/details.html#references http://whattheinternetknowsaboutyou.com/docs/details.html#re...
- TheElder 17y agoIt's