Sunday, January 13, 2013

No more spying on site visitors ... How browsers limit the :visited style

I recently came about an article describing how one could estimate the gender of visitors by checking their browser history. Apparently, feminine users visit different popular sites than masculine users. http://www.mikeonads.com/2008/07/13/using-your-browser-url-history-estimate-gender/

So, how to get access to the users' browser history when they visit your site? There were some really smart ways to do it. Unfortunately, the (popular) browsers (at least) have caught up, and none of these techniques work anymore.

The idea is tricking the browser into revealing URLs that have been previously visited when it applies a different style to those links. In plain CSS: using the pseudo class a:visited. If these techniques worked, one could add a number of links to a web page, somewhere outside the visible area, or hidden by some other elements.

  • First up: jQuery. In the perfect world $("a:visited") should find us all the links. Somebody even wrote a plugin http://remysharp.com/2008/02/25/visited-plugin/. Behind the scenes the plugin uses the JavaScript function getComputedStyle().
  • Since that didn't work out, how about changing the style of visited anchor tags so that not only their placement would be distinct, but also the positions of surrounding elements? Well, it didn't work either. The browsers (I tested) refused to apply any style attributes that would alter the rendering of the page, i.e. only color and text-decoration were recognized.
  • In my last attempt I assigned a individual background images to the :visited pseudo class for each anchor tag. Something, that could be easily generated on the sever. E.g. as a PHP script. If the browser would apply the style additional HTTP requests would be generated for those visited links.
I was not able to trick any of the browser, to reveal their history. I assume the developers got smart enough to patch this security hole. http://dbaron.org/mozilla/visited-privacy

Of course, the desire to obtain demographic information from site users still prevails. I'm looking forward to seeing what else people come up with...