History theft with CSS Boolean algebra

It wouldn't disclose any information the site can't already get by tracking clicks.

This is orthogonal to letting same-domain links have more information on their visited status too.

A number of attacks against, e.g. banks seem implausible ("but how would the attacker know that I bank at Wells Fargo?") until you learn about history stealing.

You don't do that often, though. The dynamic IP address is still one from a pool, that greatly reduces the randomness and there are other ways of identifying users.

It's true, history hacks were a lot more "fun" when you could still check 10-100s of URLs per second without any user interaction necessary.

You could pull off some very cool and unexpected tricks by applying such knowledge in a clever manner. The important thing to realize is that what you can use history information for goes way beyond "I know where you surfed last summer". That's just a mild privacy problem.

Targeting specific end-points, profile pages, stuff like that, you can leak a lot more interesting information than just someone's browsing habits. Right up to the point where you could (for certain services, under certain circumstances) cook up someone's session key and it suddenly became an actual security exploit.

Still, a couple of those tricks (or perhaps new ones) might still be worth it even if you can only query 10-20 sites. I don't know. It's not a lot of information. Though 33 bits is enough to identify any human on Earth.

> you need to make the user somehow disclose what he sees on the screen, which may often look suspicious.

Well that's the thing what this article is about, right? How it works is, there is a 32x32 grid of "close"-buttons. But you only see one of them, all the others are CSS hidden. That one you click. By virtue of which button it was, the site now knows 10 history-visited-states.

As the article says, if that looked like a "close"-button on a pop-up ad, where's the suspicion?

I use an adblocker. I get a popup, it has nothing but a "close"-button in it. I figure, "guess it only blocked part of the ad or something" and click the "close"-button without even thinking. The pop-up closes, and I've already forgotten that it happened.

The only suspicion I see could be that the "close"-button might appear in a weird, off-centre place. But that matches perfectly with the wonky-adblocker-behaviour theory in my head, so I wouldn't think twice about it.