HN Explorer

Poll: Did you know about the history sniffing exploit?

4 points by aarongough ↗ HN
Had you heard of the JavaScript history sniffing attack before it made the front page on HN?

(http://news.ycombinator.com/item?id=800693)

I'm interested to hear responses as I believe that I keep up with tech news pretty well and I had never heard of this, in my opinion, fairly serious exploit before today! Others have stated that it's old news and that everyone knows about it. I'm interested to see how the cookie crumbles (so to speak)

9 comments

[ 2.5 ms ] story [ 31.6 ms ] thread
profquail
I heard about this last year, when I read this article:

http://www.mikeonads.com/2008/07/13/using-your-browser-url-h...

Basically, it uses the socialhistory.js and some statistics to estimate whether you are male or female (which is useful information to advertisers).

EDIT: Here's the HN story on that site: http://news.ycombinator.com/item?id=248558

noodle
known about it and different forms of it for a while.

i wouldn't really call it an exploit in and of itself, though, as you can pull the information out of the css :visited pseudoclass in a variety of ways. i'd call it an unintended consequence.

aarongough
Fair enough, an unintended consequence with a plethora of uses for the evil and not-so-evil alike though...

I feel like a little bit of a failure at the moment! My only solace is that I wasn't active in the web-development (or software at all) industry when the 'exploit' was released to the wild. I guess you can't catch everything!

noodle
you'd have to go back to html 3.0 in 1997 when the vlink property was introduced to the body tag.

that would be the origin of being able to specifically color links you've visited, allowing you to set a bizarre color to visited links and let javascript traverse the dom to find links that are colored weirdly.

aarongough
I wasn't anywhere near the industry by that point. I got my professional start in 2002... Long enough to remember the 'bad old days' though!
chaosprophet
I've known about it since I encountered javascript.history.back(). I figured if js could find out my last page, then it could probably read my entire history. Since then my browser does not have any history saved.

Edit: I've never really thought of it as an exploit though.

aarongough
You understand that it's an exploit that takes advantage of the browser's CSS :visited pseudoclass right?

The JavaScript history object is specifically designed not to give 3rd parties access to your history info...

aarongough
Haha, there's no shame in answering 'No' people! I'll admit I did (and so far I'm the only one!)...

I know the HN crowd are way more aware about issues like this than the average person, but to have your fingers this firmly on the pulse of the 'net? Impressive?

EDIT: Now I'm not the only one. Misery loves company! Thanks :-p