Who am I: A mind reader (don't forget to view source)

[mbrubeck]

Here's the same exploit disguised as a game, to make it less obvious that it's tricking the user into interacting with it: http://lcamtuf.coredump.cx/yahh/

Documentation of the game proof-of-concept: http://lcamtuf.blogspot.com/2013/05/some-harmless-old-fashio...

[Fuxy]

Cool. That is a neat trick/exploit never heard of it before.

Thx. for the links.

[dzhiurgis]

My first idea was clickjacking and social networks, but that probably is impossible.

[maaarghk]

That's really good, and a very informative forum post!

[shurcooL]

Reminds me of that hunter2 password thing. http://www.bash.org/?244321

Basically, the website doesn't know which of the squares are red, that depends on your browser state. By clicking the red squares, you're feeding it data.

The interesting observation I made out of this is that navigating there in an incognito window prevents any links from being considered as visited. That's good to know.

[keerthiko]

I could probably post a similar gizmo on HN with a results static page that says

Your interests are: (some subset of) Programming Science Technology Games <random other thing: Sports, TV, childcare, etc>

With literally no scripting, and everyone would find it "reasonably accurate" :D

[espadrine]

> Your interests are: (some subset of) Programming Science Technology Games <random other thing: Sports, TV, childcare, etc>

Me being me, I clicked on random grey squares. I got exactly that.

There is a selection bias from the choice of URLs it provides.

[mdup]

At first, I thought the OP had done exactly that!

[kej]

That would be sort of a specialized version of the Forer effect: http://en.wikipedia.org/wiki/Forer_effect

[staccatomeasure]

fwiw, my results were very wrong

[joev_]

Heh. I clicked a few before I realized what was going on (looking at the status bar shows the link, which somewhat gives it away). You could prevent this by adding mouseover/out and onclick logic that removed the :href on hover and just colored itself red.

[asadlionpk]

but i guess then it won't be red on hover.

[lewisflude]

This was really accurate to me. It seems they're using a:visited on several domains to create the "red square" effect.

[cynwoody]

Yes.

And the only reason you have to click the red squares is to let it know which ones are red. If you try to look up the color of a square using GetComputedStyle, it always comes back gray. That was the resolution of privacy Bug 147777† (":visited support allows queries into global history").

†https://bugzilla.mozilla.org/show_bug.cgi?id=147777

[biot]

Here's a related Mozilla bug report from 2002 regarding the link visited issue: https://bugzilla.mozilla.org/show_bug.cgi?id=147777

[lrichardson]

Question:

I know that the `:visited` exploit is handled by the browsers so that you can't figure out by javascript what is going on...

but what if you used just CSS to figure it out? For instance, what if you generated the CSS which had a unique image it requested via the `background-image` property, stored the data on the server, then just requested the data from the server after the fact?

Do the browsers prohibit the usage of url-based css properties on CSS selectors with `:visited` or something? Does anyone have a link/reference to how the exploits were patched up?

[RussianCow]

Yes, they prohibit anything that might be used for this purpose.[0] So the CSS allowed for :visited selectors is limited to a small subset.

[0]: https://hacks.mozilla.org/2010/03/privacy-related-changes-co...

[megablast]

Could your draw the screen, then save that as a screenshot, and analyse the image?

[tomasien]

This just solved a huge problem I've been struggling with. This is beautiful - I don't actually want to know the information I've been trying to access, but it will make the experience better for the user. I now realize I don't HAVE to know - the browser knows, and that's all that matters. I just have to teach the browser what to do.

[Conlectus]

Original creator here. I'm super surprised to see this posted here.

I can answer any questions people have.

[analog31]

For those of us who don't know Javascript, I'll just ask in broad terms: What is it, how's it work, what's it do?

[lurkinggrue]

I'm not incognito mode but it didn't work for me.

Kinda weird.

[krat0sprakhar]

If nothing else, I did get a good list of Programming and Engineering websites :D - http://pastebin.com/zrQ7EBnP

[schme]

This is OT, trivial and a bit silly: How did you intend the json file? I tried with sublime but couldn't find anything to solve it. Didn't start an IDE for this.

[ianamartin]

I know, right? 10,000-ish ways to waste time at work.

[danbruc]

Obvious question - how was the list of URLs compiled? Some are really specific like YouTube channels. On the other hand there are only 15 categories and there are probably a lot of people that would not get a single match or only something very generic like Wikipedia.

[Conlectus]

Creator here. The links were gathered by searching feedlys feed suggestions for different topics.

[yzzxy]

The coolest way would be cold, hard natural selection from Alexa top sites, possibly with weighting placed to relevant sites at the introduction of the dataset. Perhaps I will fork.

[tomblomfield]

fivethirtyeight.com appears about a dozen times for me?

[collinjackson]

Here's a paper about this technique: http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010....

[3rd3]

Couldn't one simply make a display:none on normal links and display:block on :visited, then stack them all on top each other with position:absolute and catch mouse events from each element via JS?

[heycam]

Browsers have a very limited set of properties that they allow in :visited rules, and display isn't one of them.

[mataug]

This is quite clever. By the way now I've got a nice list of blogs/websites that I should probably read for various topics.

[amjd]

That's what I was thinking too. Here's a prettified list of the sites used: https://gist.github.com/amjd/acc5e108bfb2f29f050c

[rdrey]

I was also thinking of using it as a bookmarks site. :)

[krrishd]

If you open the console and run this script, it'll click every single square, giving a list of the most common types of sites in the array being used:

     for(i=0;i<$$('a').length;i++) {
       $$('a')[i].click()
     }

[PurplePanda]

I had to change it to start at i=1 to avoid clicking on the link to github and leaving the page

[SahAssar]

I remember reading about the old CSS history hack (an automated variation of the same theme), which worked until FF4 and IE9.

It's quite interesting to see how such a seemingly simple feature (a:visited) can completely override user privacy if not accounted for.

[irises_come]

Hm. Do you really need interaction at all?

Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?

[gburt]

This is a very old attack that has numerous security measures to prevent you from doing that now.

[siddboots]

I remember there being a long string of attacks related to hooks of this kind, but as far as I know it is no longer a problem at all.

It's a good example of just how difficult browser security is.

[borkabrak]

The page itself can't tell what color the squares(links) are rendered as to the user. That's what the clicking is for. Mwaahaha...

[Xeroday]

Was on incognito and wondering why I didn't see any red squares...

[mataug]

That is, I am guessing, because there aren't any re-marketing cookies,history and other markers when you open the page in incognito

[MrJagil]

Interesting.

At first I thought it would deduct information about me by analysing which squares I'd choose in what order and through other metrics like pacing.

[cornholio]

"Could not determine interests. (Pssst, If you did not get any red squares, try visiting without being in Private or Incognito mode)"

Indeed I am unhackable.