Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by rightbyte | Hacker News Reader

Full thread

rightbyte·

This is a terrible PI leak ...

JS should really be disabled by default and only be enabled on sites that really need it and you somewhat trust.

View on HN

It does not require js to work. In essense, it uses css styles to exploit visited links.

Also, lying the visited state on JS was implemented as early as Firefox 4 - so it is definitely not a JS-dependent "exploit" (rather, it's a rather oblique way of social engineering).

But dont you need js to check for the styles to see if the link is visited?

No, each square the user clicks could be a checkbox that is submitted to the backend as a form when they click done.

It could even just use CSS selectors to reveal an image or change a background image that results in a request to the backend.

Fortunately most browsers already have some measures to prevent that (https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...), the demo avoids automating the process altogether, and relies on tricking the visitor into 'voluntarily' telling if they've visited a site.

I meant you can use CSS on the checkbox once it is checked, there is no need to actually submit a form. I understand that you can't use CSS directly on the :visited selector.

Ah I see, that makes sense.

You need js to extract the PI though?

This one does not really need JS, the captcha could be done with an HTML form and checkboxes.

captchas which are not working with noscript/basic (x)html browsers are definitive no-no anyway.

You can do requests to the site using pure CSS as well, using something like `.site:visited { background-image: url(/logging/site); }`

those kind of tricks are already blocked by browsers, as the article explains

JS or user submitting a form -- some form of client interaction.

I had to enable js for it to work in firefox

Reply on news.ycombinator.com