[{"data":1,"prerenderedAt":311},["ShallowReactive",2],{"project-7868211":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":42,"post_text":45,"what":46,"said":64,"maker_in_thread":140,"shape":151,"grid":155,"attempts":274,"same_week":275,"maker_shows":34,"maker_hidden":303,"reader_version":304,"card":305},"7868211","visited-captcha-history","Tricking the user to access history using CSS and captchas","title","Show HN: Tricking the user to access history using CSS and captchas","http:\u002F\u002Ffrantzmiccoli.github.io\u002Fvisited-captcha-history\u002F","frantzmiccoli.github.io","frantzmiccoli",1402318746,2014,140,47,183,2272,9,"notable","security_privacy","browser history leak demo","web_app",[24,25,26,27],"browser history","css visited links","captcha","privacy attack","curious",0.204,{"positive":31,"neutral":32,"mixed":33,"critical":34},4,11,2,1,18,{"design":37,"execution":39,"privacy":40,"idea":41},{"positive":34,"critical":38},0,{"positive":38,"critical":38},{"positive":34,"critical":34},{"positive":33,"critical":38},[43,38,44,38,44,44,43,44,44,44,43,34,38,38,38,38,38,44,38,38,44,38,44,44,44,43,38,38,38,38,38,38,38,38,38,38,38,38,38,38],5,3,null,{"problem":47,"audience":45,"pricing":45,"motivation":45,"time_to_build":45,"stack":61,"openness":62,"stage":63,"team_size":62},{"value":48,"source":49,"evidence":50},"Reveals which websites a user has visited by abusing CSS :visited styling through a fake captcha.","inferred",[51,53,57],{"id":52},"post",{"id":54,"by":55,"text":56},"7869195","cissou","Brilliant. getComputedStyle used to give away the color of a link, so at some time this attack was trivial: you didn't need any user input, as a blue link meant :unvisited, and a…",{"id":58,"by":59,"text":60},"7868605","CheckHook","Interesting but this method is limited to the URLs that you list in the javascript (in this case linklist.js). More of a specific validation to see if the user has visited the…",[],"unknown","prototype",{"praise":65,"objections":76,"requests":96,"questions":112,"alternatives":121},[66],{"value":67,"source":68,"evidence":69},"Clever proof of concept for a known history-sniffing attack","commenter",[70,71,75],{"id":54,"by":55,"text":56},{"id":72,"by":73,"text":74},"7869656","nej","Clever",{"id":58,"by":59,"text":60},[77,85],{"value":78,"source":68,"evidence":79},"Only checks a hard-coded list of URLs, so it is not a full history scrape",[80,81],{"id":58,"by":59,"text":60},{"id":82,"by":83,"text":84},"7869495","ultimatedelman","What am I missing? I just got this pre-determined list of links: https:\u002F\u002Fgithub.com\u002Ffrantzmiccoli\u002Fvisited-captcha-history\u002Fblob\u002Fmaster\u002Fjs\u002Flinkslist.js I was impressed when this…",{"value":86,"source":68,"evidence":87},"Browsers should stop letting off-domain :visited styles be read",[88,92],{"id":89,"by":90,"text":91},"7870476","mikelat","That's impressive. Honestly modern browsers should just start ignoring off-domain :visted styles.",{"id":93,"by":94,"text":95},"7871313","spb","That would break aggregator sites like HN and Reddit (although really they should really be maintaining the visit history themselves, as they do with Reddit Gold users).",[97],{"value":98,"source":68,"evidence":99},"Make the captcha letters unselectable and block pointer events so the hidden text cannot be dragged out",[100,104,108],{"id":101,"by":102,"text":103},"7868819","NathanKP","Very nice concept. You should also add the following CSS to the captcha letters: ``` -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none;…",{"id":105,"by":106,"text":107},"7873531","mzs","Works now, but you might want to block pointer events too, for example I can drag with the mouse from the captcha into the text area below to get a URL.",{"id":109,"by":110,"text":111},"7870807","bennettfeely","Alternatively, pointer-events: none; will do all the above in one property. Better cross-browser support also.",[113],{"value":114,"source":68,"evidence":115},"Why did the list show sites not visited today",[116,117],{"id":82,"by":83,"text":84},{"id":118,"by":119,"text":120},"7869539","gkoberger","It's site's you've visited at any time in the past (since the cache was cleared). Anything that would normally show up as purple rather than blue on regular websites.",[122,129],{"value":123,"source":68,"evidence":124},"Timing-based style render history attacks",[125],{"id":126,"by":127,"text":128},"7870202","aaronm67","There was a pretty interesting talk about using differences in style render time to get history. https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=KcOQfYlyIqw It's pretty interesting, and can be…",{"value":130,"source":68,"evidence":131},"Academic paper on browsing history leaks via side channels",[132,136],{"id":133,"by":134,"text":135},"7870216","linshunghuang","You might want to check out the research paper \"I Still Know What You Visited Last Summer Leaking browsing history via user interaction and side channel attacks\" (…",{"id":137,"by":138,"text":139},"7870881","kedean","Another interesting, more recent paper (I couldn't find a link to the actual pdf, but I'm sure people are resourceful): http:\u002F\u002Fdl.acm.org\u002Fcitation.cfm?id=2516712 This one…",{"comments":43,"answered":38,"key":141},[142,145,148],{"id":143,"text":144},"7868973","Done, thanks for the hint ;)",{"id":146,"text":147},"7872020","I didn't applied the style to the right element... My bad!",{"id":149,"text":150},"7868662","Rebuilding the full user history would be impossible, but finding a few compromising websites would be easy.",{"commenters":152,"max_depth":43,"maker_replies":43,"first_comment_mins":153,"lifespan_hours":154},37,86,28,[156,158,160,163,165,167,168,172,174,176,177,178,180,182,185,189,192,195,199,201,204,205,206,209,212,214,217,219,222,224,226,230,232,235,238,241,243,246,249,252,255,257,259,262,265,268,271],[101,38,43,157,102,38],"project\u002Fpositive\u002Fdesign",[143,38,38,159,11,34],"maker\u002Fneutral\u002Fnone",[161,38,44,162,106,38],"7869294","project\u002Fmixed\u002Fexecution",[146,38,38,164,11,34],"maker\u002Fneutral\u002Fexecution",[105,38,44,166,106,38],"project\u002Fneutral\u002Fexecution",[109,38,44,166,110,38],[169,34,44,170,171,38],"7868592","project\u002Fneutral\u002Fprivacy","jere",[54,33,43,173,55,38],"project\u002Fpositive\u002Fidea",[126,33,44,175,127,38],"project\u002Fneutral\u002Fidea",[133,44,44,170,134,38],[137,44,44,170,138,38],[89,31,43,179,90,38],"project\u002Fpositive\u002Fprivacy",[93,31,34,181,94,38],"project\u002Fcritical\u002Fprivacy",[183,31,44,170,184,38],"7871387","adrr",[186,31,38,187,188,38],"7871393","other\u002Fneutral\u002Fnone","endianswap",[190,31,38,187,191,38],"7871810","tokenizerrr",[193,31,38,187,194,38],"7871887","mschuster91",[196,31,38,197,198,38],"7871998","commenter\u002Fneutral\u002Fnone","DavidSJ",[200,31,38,197,194,38],"7873244",[202,31,38,187,203,38],"7871984","gohrt",[82,43,44,166,83,38],[118,43,38,197,119,38],[207,43,38,197,208,38],"7869630","yournemesis",[58,210,44,211,59,38],6,"project\u002Fmixed\u002Fprivacy",[149,210,38,213,11,34],"maker\u002Fneutral\u002Fprivacy",[215,210,44,166,216,38],"7868792","jengamaster",[218,210,38,164,11,34],"7868963",[220,210,44,170,221,38],"7868921","mikeash",[223,210,44,170,55,38],"7869185",[72,225,43,173,73,38],7,[227,228,38,187,229,38],"7869642",8,"dang",[231,228,38,159,11,34],"7870020",[233,18,38,187,234,38],"7868581","thinkbohemian",[236,18,38,187,237,38],"7868639","aroch",[239,18,38,187,240,38],"7868918","brenschluss",[242,18,38,187,221,38],"7869553",[244,18,38,197,245,38],"7869228","comrh",[247,18,38,187,248,38],"7869290","cfqycwz",[250,18,38,187,251,38],"7869516","okasaki",[253,18,38,187,254,38],"7869616","hyperpape",[256,18,38,187,229,38],"7869550",[258,18,38,187,254,38],"7869596",[260,18,38,187,261,38],"7868644","Nickoladze",[263,18,38,187,264,38],"7868906","zacharydanger",[266,18,38,187,267,38],"7868916","dethstar",[269,18,38,187,270,38],"7868737","octagonal",[272,18,38,197,273,38],"7870301","owenversteeg",[],[276,281,286,290,294,299],{"id":277,"name":278,"points":279,"category":280},"7862578","json_resume",187,"productivity",{"id":282,"name":283,"points":284,"category":285},"7868368","Bounce.js",172,"dev_tools",{"id":287,"name":288,"points":289,"category":285},"7858296","GoNative",148,{"id":291,"name":292,"points":293,"category":285},"7858828","Silk",113,{"id":295,"name":296,"points":297,"category":298},"7869726","Front",94,"web_saas",{"id":300,"name":301,"points":302,"category":285},"7872113","Go HTTP Router Benchmark",89,false,"v2",{"id":306,"name":5,"line":6,"ai":303,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":307,"top":18,"kw":308,"maker":11,"domain":10,"tier":19,"attempts":38,"strip":309,"url":9,"mix":310,"praise":67,"objection":78,"sub":21},7868211,0.2,[24,25,26,27],"5030335333510000030030333500000000000000",[31,32,33,34],1794036518855]