Hacker News Reader

Comment by balls187 | Hacker News Reader

I thought the a:visited exploit was addressed.

I spent an unfortunate chunk of time trying to auto-click all the red square via jquery in chrome console. After a lot of reading and experimenting, I can verify that the exploit is thoroughly addressed (so far), and I cannot achieve my goal because of it :(.

The most promising workaround would be to find a JS screenshot tool that doesn't rely on the DOM, and then run some client-side image analysis to get the index values of the red squares, and then go from there to click the things. Well played, exploit fixers, well played.

I don't think there actually is a way to take screenshots, w/o relying on the dom.

You could access the webcam and zoom/enhance the reflection in the eyes to get the screenshot.

Think I just found a way using canvas with a semi transparent element inside of it, then overlaying that on each square, grabbing the computed/resulting color of the canvas to decipher which block is what. S O O N

I tried doing this:

http://jsfiddle.net/path411/sRkWq/

It appears as though Chrome (37-dev) will not receive any data from behind the canvas, while IE11 and FF(29) will allow me to see pixels behind the canvas, but only see the unvisited color.

I don't believe there is another method to receive the color of a pixel from a canvas except through getImageData(), but I could be wrong.

It was. The site can't know by itself what links are visited. It asks you to click on the visited (red) links, thereby giving it data.

That's why you have to click. Before the a:visited exploit was patched, a simple loop with GetComputedStyle would have sufficed. If you do that in a modern browser, all the squares come back color gray. The content script only gets to see the style attributes as they would be in the unvisited state.

The browser wont let the page get at the data, that is what was fixed, but you can still show visited differently to the user, and if you make only the visited visible and get the user to interact that information is revealed.

Reply on news.ycombinator.com