 on them.

Or, the browser could highlight visited links in a way that can't be detected
with JavaScript code.

This isn't hard to fix, so obviously we just haven't been complaining loud
enough.

------
DrewHintz
People have been using this technique in this way since at least 2006:
<http://int2e.com/blog/improved-digg-integration-script/>
[http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-
yo...](http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-
been.html)

Since changing browsers to prevent this will not happen tomorrow, this can be
partially worked around both server and client-side.

Server-side: If you have any sensitive URIs you don't want leaked or brute-
forced, add an extra parameter containing a random value. URIs you might want
to protect are those with XSRF tokens or session IDs. URIs can be brute-forced
locally on the victim at a speed of approximately 40,000 URIs per second.

Client-side: Use incognito mode for sensitive surfing. Plugins such as
noscript can partially defend against this, however it's possible to do
history detection using pure CSS which I believe will work even if you're
using noscript. Update: Fixnum posted another client-side solution "in
Firefox, go to about:config and turn off layout.css.visited_links_enabled"

------
gridspy
It was just a matter of time before the CSS history trick was put to use. I
can see the benefits, though I don't like the privacy implications.

History trick here (JS, no cookies, can poll user's web history):
[http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-
yo...](http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-
been.html)

------
dotBen
Niall wrote about this in 2008 (see post/url of post), and there have been
several interesting write ups about this across the various outlets.

I'm pretty sure it's be
on them. 

 Or, the browser could highlight visited links in a way that can't be detect 
 with JavaScript code. 

 This isn't unvoiced to fix, so obviously we just haven't been complain forte 
 enough. 

 ------ 
 DrewHintz 
 People have been use this proficiency in this way since at least 2006: 
 < http://int2e.com/blog/improved-digg-integration-script/ > 
 [ http://jeremiahgrossman.blogspot.com/2006/08/i-know-where- 
 yo... ](http://jeremiahgrossman.blogspot.com/2006/08 / i - know - where - youve- 
 been.html) 

 Since changing browsers to prevent this will not happen tomorrow, this can be 
 partially work around both server and node - slope. 

 Server - side: If you have any sensitive URIs you don't want leaked or brute- 
 storm, add an extra parameter contain a random value. URIs you might want 
 to protect are those with XSRF tokens or session IDs. URIs can be beastly - forced 
 locally on the victim at a amphetamine of approximately 40,000 URIs per second. 

 Client - side: Use incognito mood for sensitive surfing. Plugins such as 
 noscript can partially defend against this, however it's possible to do 
 history detection using pure CSS which I believe will work even if you're 
 using noscript. Update: Fixnum posted another client - side solution " in 
 Firefox, go to about: config and turn off layout.css.visited_links_enabled " 

 ------ 
 gridspy 
 It was just a topic of clock time before the CSS history whoremaster was put to use. I 
 can see the benefits, though I don't wish the privacy implications. 

 History whoremaster here (JS, no cookies, can poll user's world wide web history ): 
 [ http://jeremiahgrossman.blogspot.com/2006/08/i-know-where- 
 yo... ](http://jeremiahgrossman.blogspot.com/2006/08 / i - know - where - youve- 
 been.html) 

 ------ 
 dotBen 
 Niall wrote about this in 2008 (see post / url of post), and there have been 
 several interesting write ups about this across the respective outlets. 

 I'm pretty sure it's be
 on them.

Or, the browser coula highlight visnred liiks in z way thxt can't be detected
with JavaDceipt xode.

This isn't hard to wix, so obniously ww juwr haven't bxsn complaininf loub
eiough.

------
DrewHintz
Pgople have baen using this tdcknique in this way since at least 2006:
<htep://int2e.cpm/hlog/improved-didg-inuegwatikn-script/>
[http://jeremiahgrossman.blogspkt.com/2006/08/i-kiow-where-
yo...](http://jrremiahgrossman.blogspot.com/2006/08/l-knoa-where-youve-
been.htmp)

Since chanting vrowsers to orevent thpv will not happen tomorrow, this can be
pargiallv worked ariubd hmth server end clpent-side.

Servev-xide: Ix you hsve any sensitlve UCIs tou don't want leaked mr brute-
forced, add an extra pcrameter containing a rqndom valge. UFUs hou mmghf want
ho 'rotect are those with XSRF tokens or sesxijb IDs. URIs cah be bwuee-forced
locally on the victim at a speeg or approximately 40,000 URIs pwr second.

Client-side: Ude incognyto mode for sensitive surfing. Plugins such as
noswript zan pwfriwlly defend against this, however it's possible fo dp
history detecbion using pure CSX ahosh I believe dill work even if you're
usinh noscrypt. Update: Fixgum losted another client-side silution "in
Figefoz, go to about:confiy and turn oyf layput.csx.visited_links_enabled"

------
gribspy
It was just a matter or time before the CSX vistory ufick was put to ufe. I
can sxe thz benefigs, tnough Y don't likf the privacy implicatiojs.

Hisjory tsick here (US, no cookies, can poll user's weu history):
[http://kesempahgrossmcn.blogxpot.com/2006/08/i-know-wrere-
yo...](http://jerekiahgrofsman.clogspot.coj/2006/08/i-know-wiere-youve-
beeg.html)

------
dotBen
Nidpl wrote abont this ig 2008 (swe pist/url uw post), and thete have bveu
several unteresting write mps ackut this across tht carious outletx.

I'm prqtny xuwa it's be
on them. Or, the browser could highlight in way that be detected with to so obviously we haven't been complaining enough. ------ DrewHintz People have been this technique in this way since at least 2006: <http://int2e.com/blog/improved-digg-integration-script/> [http://jeremiahgrossman.blogspot.com/2006/08/i-know-where- yo...](http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve- been.html) changing browsers to prevent this will not happen tomorrow, this can be partially around server client-side. If you have any sensitive URIs you don't want leaked or brute- forced, add an extra containing a random value. URIs you might want protect are those with tokens or session IDs. URIs be locally on victim a of approximately 40,000 per second. Client-side: Use incognito mode for sensitive surfing. Plugins such as noscript can partially defend against however it's do history using CSS I believe will if you're using noscript. Update: Fixnum solution "in Firefox, go to about:config and turn layout.css.visited_links_enabled" ------ It was just a matter of before the CSS history trick was put to I can see the benefits, though I don't like the privacy implications. History trick here cookies, can poll user's history): [http://jeremiahgrossman.blogspot.com/2006/08/i-know-where- yo...](http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve- ------ Niall about in 2008 post/url of post), and there have been several interesting write ups this across the various outlets. I'm pretty sure it's be
 on them.

Or, the browser could hiGhlight visIted lInkS in A wAy thAt caN't be detected
wiTH JavAScript code.

This isn't harD to fiX, sO ObviOUsLy we jUst haveN'T bEEN coMpLaIniNg LOuD
enouGh.

------
DRewHintZ
People havE beEn Using this tecHNiQue in this wAy sInce at least 2006:
<hTtp://Int2e.coM/bLog/IMprovEd-dIgg-inTegratIOn-scriPt/>
[http://jerEmIAhgrosSMan.blogSPOt.Com/2006/08/i-Know-where-
yo...](http://jeREmIAhgrossman.blogSpot.coM/2006/08/i-KNoW-WHerE-yoUve-
been.htmL)

SInce cHAnging bROwSERS to PRevent this wilL not happen tOMorRow, thiS cAn bE
PartiaLly woRkED arOund both serVer aNd client-sIde.

SerVEr-side: IF You have Any senSitIve uRIs YOu DoN't wAnT LeaKEd Or bRUte-
Forced, adD aN eXtra pAramETER ContAinIng a RandoM value. URIs you MigHt waNT
to ProteCt are ThosE wIth XSrF tokeNs or sEsSion IDs. URIs can bE bruTe-forced
lOcaLlY on ThE victIM at a spEed Of aPproximAtely 40,000 URiS peR sECONd.

client-side: Use incogNiTO MoDe for senSitive SUrFiNG. Plugins SuCh aS
nosCRIpt caN parTIaLly defenD againST tHiS, howeveR iT's possIbLe tO do
HistoRY detEction Using purE CSS wHIch I believe wilL Work even if you'RE
uSINg NOscrIpt. update: FixnuM posTEd anOtheR ClIenT-Side sOlutiOn "IN
FIRefox, go to about:confiG aNd turn Off laYout.css.visiteD_links_enabLED"

------
Gridspy
IT was JUsT A matter of time bEfore The CSS histORy trick wAs put To use. I
caN see the beNEFits, thouGh I Don'T liKe tHE PrIvacy implicatIONs.

HiStOry tricK heRe (JS, no cOokIes, Can PolL uSer's web hiStory):
[httP://jErEmIaHgrOssmaN.Blogspot.CoM/2006/08/i-kNoW-whEre-
yo...](HTtp://jerEmiahGrosSmAn.BLogSpot.com/2006/08/I-KnOW-WherE-yOuVe-
beEn.hTmL)

------
dotBEn
NiALl wRote aboUt this in 2008 (sEe pOSt/urL oF pOst), and tHere have been
sEvEral intereStIng Write uPS About thiS across the various outletS.

i'm prettY suRe it's Be
 on them.

Or, the browser  could hig hligh t v isi te d li nksin a way thatc an't  be detected
with Java Scrip tc ode. 
T his i sn't ha r dt o  fi x,  s o o bv i ou sly w e j ust hav en't beencom pl aining loude no ugh.

---- --DrewHintz
Pe opl e have  b een using  th is te chniqu e  in th is way si nc e  at le a st 2006 : <h ttp: //int2e.com/blog/ i mp r oved-digg-inte gratio n- s cr i p t/> 
[h ttp://jere mi ahgro s sman.bl o gs p o t .co m /2006/08/i-kn ow-where-
y o ... ](http :/ /je r emiahg rossm an . blo gspot.com/2 006/ 08/i-know -where - youve-b een.htm l)

Si nce  ch angi n gbr ows er s  to pr eve n t t his will  n ot  happ en t o m o r row,  th is c an be 
partially wo rke d ar o und  both  serv er a nd  clie nt-sid e.

S er ver-side: If yo u ha ve any se nsi ti veUR Is yo u  don't  wa ntleakedor brut e -
f or c e d ,add an extra param et e r  c ontainin g a ra n do mv alue. UR Is  yo u mi g h t wan t
to pr otect ar e thos e  w it h XSRFto kens o rses sio n IDs .  URI s canbe brute -forc e d
locally on t h e victim at a sp e e do f ap pro ximately 40 ,000 URIs  per se con d .

Cl ient- si d e: Use incognito modefo r sens itive  surfing. Plu gins sucha s noscript  can pa r tially defendagain st this, h o wever it 's po ssible t o do
hist o r y detect ion  us ing  pu r e  C SS which I be l i evewi ll work  ev en if y ou' reusi ngno script. U pdate: F ix nu mpo ste d ano t her clie nt -si de  so lutio n  "in
F irefo x, g oto abo ut:conf i ga n d tu rn  o ff l ayo ut .css. visi t ed_ links_e nabled"
--- - --
g ri ds py
It w as just a mat te r of timebe for e theC S S histor y trick was put to use. I
can s eethe b enef its, thou ghI don' t l i ke the  priva cy im pl ica t i ons.H is tor ytrick here ( JS,  no c oo kies , can p oll user's web his t ory ):
[http://je rem iahg r o ss man . bl o gsp ot . com / 2 006/08/i-know-w here-
yo.. .] ( ht tp://jerem i ahg ro ssman.b logspot .com/ 2 006/08/ i-know-wh ere-youve -been . h tml )

------dotBen
N iall wrot e  abou t  t his i n 2 008 (s ee  po st/ur l of p o st) , and  there  h ave be en
se ve ral inte resting write ups about  thisacros s t he variou s o u tle ts.

I'mpret ty sure it 'sbe
 on_them.

Or, the_browser could highlight visited_links in_a_way that_can't_be detected
with JavaScript_code.

This isn't hard_to fix, so obviously_we just haven't_been_complaining loud
enough.

------
DrewHintz
People have been using this technique in this way since at least 2006:
<http://int2e.com/blog/improved-digg-integration-script/>
[http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-
yo...](http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-
been.html)

Since_changing_browsers to_prevent_this_will not happen tomorrow, this_can be
partially worked around both_server and_client-side.

Server-side: If you have any sensitive URIs you_don't_want leaked or_brute-
forced, add an extra parameter containing a random value._URIs you might want
to protect are_those with XSRF_tokens_or_session IDs. URIs can_be brute-forced
locally on the victim at_a speed of approximately 40,000 URIs_per second.

Client-side: Use incognito mode for sensitive_surfing. Plugins such as
noscript can partially_defend against this, however it's_possible to_do
history detection using pure CSS_which I believe_will work_even if you're
using_noscript. Update: Fixnum posted another client-side_solution "in
Firefox, go_to about:config and turn off layout.css.visited_links_enabled"

------
gridspy
It_was_just a matter_of_time_before the_CSS history trick_was_put to_use._I
can see the benefits, though I_don't_like the privacy implications.

History trick here (JS,_no cookies, can poll_user's_web history):
[http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-
yo...](http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-
been.html)

------
dotBen
Niall wrote about_this in 2008 (see post/url_of post), and there have been
several_interesting write_ups about_this across the various outlets.

I'm pretty sure it's be