visited-captcha-history
Security and privacy
browser history leak demo
SHOW HN2014
visited-captcha-history
Tricking the user to access history using CSS and captchas
frantzmiccoli.github.ioHow HN took it
4 positive, 11 neutral or asking, 2 mixed, 1 critical, out of 18 comments about the project. Thread score +0.20.
Privacy: 1 for, 1 againstIdea: 2 for, 0 againstDesign: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clever proof of concept for a known history-sniffing attack
From 3 comments
Brilliant. getComputedStyle used to give away the color of a link, so at some time this attack was trivial: you didn't need any user input, as a blue link meant :unvisited, and a…
cissou on HNClever
nej on HNInteresting but this method is limited to the URLs that you list in the javascript (in this case linklist.js). More of a specific validation to see if the user has visited the…
CheckHook on HN
Objections
Only checks a hard-coded list of URLs, so it is not a full history scrape
From 2 comments
Interesting but this method is limited to the URLs that you list in the javascript (in this case linklist.js). More of a specific validation to see if the user has visited the…
CheckHook on HNWhat am I missing? I just got this pre-determined list of links: https://github.com/frantzmiccoli/visited-captcha-history/blob/master/js/linkslist.js I was impressed when this…
ultimatedelman on HN
Browsers should stop letting off-domain :visited styles be read
From 2 comments
That's impressive. Honestly modern browsers should just start ignoring off-domain :visted styles.
mikelat on HNThat would break aggregator sites like HN and Reddit (although really they should really be maintaining the visit history themselves, as they do with Reddit Gold users).
spb on HN
Requests
Make the captcha letters unselectable and block pointer events so the hidden text cannot be dragged out
From 3 comments
Very nice concept. You should also add the following CSS to the captcha letters: ``` -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none;…
NathanKP on HNWorks now, but you might want to block pointer events too, for example I can drag with the mouse from the captcha into the text area below to get a URL.
mzs on HNAlternatively, pointer-events: none; will do all the above in one property. Better cross-browser support also.
bennettfeely on HN
Questions
Why did the list show sites not visited today
From 2 comments
What am I missing? I just got this pre-determined list of links: https://github.com/frantzmiccoli/visited-captcha-history/blob/master/js/linkslist.js I was impressed when this…
ultimatedelman on HNIt's site's you've visited at any time in the past (since the cache was cleared). Anything that would normally show up as purple rather than blue on regular websites.
gkoberger on HN
Alternatives named
Timing-based style render history attacks
From 1 comment
There was a pretty interesting talk about using differences in style render time to get history. https://www.youtube.com/watch?v=KcOQfYlyIqw It's pretty interesting, and can be…
aaronm67 on HN
Academic paper on browsing history leaks via side channels
From 2 comments
You might want to check out the research paper "I Still Know What You Visited Last Summer Leaking browsing history via user interaction and side channel attacks" (…
linshunghuang on HNAnother interesting, more recent paper (I couldn't find a link to the actual pdf, but I'm sure people are resourceful): http://dl.acm.org/citation.cfm?id=2516712 This one…
kedean on HN