Hm. Do you really need interaction at all?
Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?
Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?
I don't see any secure way to handle this besides disallowing :visited styling entirely.
Now make it even less obvious: create a false box with the proper :visited color. That's your bottom layer, your fallthrough if the user hasn't visited any of them. Now position all of the :visited boxes as exactly the same size and position over that bottom layer. Now, when the user clicks the button to continue, they're guaranteed to click either your fallthrough ("user has none of my sites") or one of those you are monitoring for.
The end result of all this is a page that says "Click the box to continue."
Then it would remain 'none' for the visited box too. Messing with 'display' is disabled in 'visited' to prevent this class of workarounds.
That's what I think he meant.
It's a good example of just how difficult browser security is.