NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/
But since it’s possible, even though slow and unpractical, performing the same trick without using JavaScript, the only full-blown protection is SafeHistory
Code: Select all
a:visited{
background: none !important;
background-image: none !important;
list-style-image: none !important;
} No it doesn't, for instance:luntrus wrote:the Fx plugin Stylish (https://addons.mozilla.org/en-US/firefox/addon/2108) can. Make the following (global) style:O.K. that works,Code: Select all
a:visited{ background: none !important; background-image: none !important; list-style-image: none !important; }
Code: Select all
#playboy:visited span { bakground-image: url(/log.php?url=playboy.com) }
#google:visited > div { list-style-image: url(/log.php?url=google.com) }
Absolutely not. The HTTP Referer header has nothing to do with history sniffing.luntrus wrote: but there is yet another way to block this with an extension, named: RefControl
Sorry, that's incorrect too. This trick is not related to Meta Redirects either.luntrus wrote: There is also a third way namely to block all Meta Redirects then this sniffing also does not function anymore,
Unluckily not.luntrus wrote: So there are more ways to kill the proverbial cat,
Yes.Tom T. wrote:Can a history-sniffing attack truly work if I clear ALL data in "clear private data/settings" in between website visits? No details needed, just yes or no -- just curious.
If you mean, "does anyone really clear all private data before going to the next site", the answer is yes. One person, at least (this one). Usually, by closing and re-starting the browser, which dumps the data and also Sandboxie empties the entire sandbox, in which the browser data were trapped anyway.Giorgio Maone wrote:Yes.Tom T. wrote:Can a history-sniffing attack truly work if I clear ALL data in "clear private data/settings" in between website visits? No details needed, just yes or no -- just curious.
But does anybody really do that?...
For this attack on your privacy, you're safe. But as luntrus pointed out, when you navigate from one site to another you tell the destination where you're coming from (Referer HTTP header, I use RefControl for that), and if you've got 3rd party cookies enabled you tell centralized entities a lot of stuff about what you're doing (use CS Lite for that).Tom T. wrote:But if I understand you correctly, SafeHistory, which I just installed yesterday on your advice, defeats these attacks, so there is no more to worry about, correct?
A long time ago, there was a tool called GuideScope that, among other things, stripped referrer headers. Will look at Ref Control, thanks.Giorgio Maone wrote:... But as luntrus pointed out, when you navigate from one site to another you tell the destination where you're coming from (Referer HTTP header, I use RefControl for that),
and if you've got 3rd party cookies enabled
Will do, thanks.On a side note, history sniffing could be (in a much more sophisticated way) be replicated by comparing load latencies and "guessing" if a certain resource come from your cache (visited) or not. Use "SafeCache" (which performs cache fragmentation just like SafeHistory does with history, from the same Stanford people) to defeat that.
We both are among that Venn set (category 3 here), but you left out his affair with the 18-year-old. And my entire country thanks yours for proving that we are not the only country whose politicians are corrupt sexual deviants who pass laws granting themselves immunity.Of course I would worry about one site guessing the sites I've visited from a fixed list only if I was a Chinese/Iranian blogger, an Al Qaeda turrist, an US citizen or under the dictatorship of a 72 years old dwarf clown who owns all the media in my country... oh wait
Yes, the story made it here, since it has everything the US audience wants: sex, power, money, scandal, corruption, bribery, and a hot chick who calls him "Daddy". 
Tom T. wrote: Will look at Ref Control, thanks.
... is really a good advice.Additionally, you can specify the default behavior for any site not in the list. You can set this to something other than Normal if you want to be more protective about your privacy. Setting it to Block for 3rd Party requests only is a fairly good compromise between privacy and not breaking sites. If you change the default behavior and then want a site to get sent the actual referrer, add it to the list and set it to Normal.