TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

History theft with CSS Boolean algebra

119 点作者 afreak将近 11 年前

5 条评论

heydenberk将近 11 年前
There are a bunch of these exploits — I remember one a few weeks ago that posed as a mind-reading survey — and I think they can only be well and truly solved by a same-domain policy for :visited links. In short, don't apply :visited styling to a link unless that link is the same domain as the host page. This is the general security model on the rest of the web and it'd work here.
评论 #7941180 未加载
评论 #7941657 未加载
评论 #7941085 未加载
thegeomaster将近 11 年前
Considering the work needed by the website to convince the user to give away the data, and even with approaches like described with the article, we may be overestimating what websites could learn of us by checking if we&#x27;ve visited some random 2, or 4, or 15 sites.<p>Yes, it&#x27;s an invasion of privacy and has to be sanitized, but it&#x27;s not like that websites can see all of your history, view it in chronological order, or know if you&#x27;ve visited this link 6 months ago or today. And plus, you need to make the user somehow disclose what he sees on the screen, which may often look suspicious.<p>And what would an adversarial website do with these {visitedlinks, IP} tuples? Hit me with personalized ads or sell that modicum of my history to some ad company? Big shit, I hit the reset button on my router, and I get a new dynamic IP address from the ISP. The site now knows nothing.<p>These work more as proof-of-concepts. The inconvenience they require to be collected, paired with the limited utility of the results, makes for an unattractive attack vector.<p>I agree that if someone wants to target specifically you and knows something about you, they can put this class of exploits to a more threatening use, such as (if you&#x27;re at work) seeing if you&#x27;ve visited some company LAN URL. Or perhaps they can see if you&#x27;ve accessed the admin pages on some website they&#x27;re targeting, so they can determine if you have admin rights there.
评论 #7948807 未加载
评论 #7941816 未加载
评论 #7941897 未加载
评论 #7941707 未加载
epmatsw将近 11 年前
Oh neat, I thought this was broken at first since it said that I hadn&#x27;t visited news.ycombinator.com. Then I remembered that after seeing a similar (though less clever) exploit a few weeks ago, I&#x27;d changed Firefox to not show visited styles. I&#x27;d call that a success.
erikano将近 11 年前
&gt;[...] for those using non-WebKit browsers, here&#x27;s a slightly modified version that will do the trick for you [...]<p>All four are grey in Firefox for Android.
评论 #7943161 未加载
tripzilch将近 11 年前
Wow. Lcamtuf is such a king of side-channel attacks.<p>Using opacity quantization&#x2F;rounding errors to get around CSS :visited restrictions ... crazy brilliant.