Timing attack against HSTS to sniff browser history in Chrome and Firefox

Re:Timing attack against HSTS to sniff browser history in Ch... by SanPilot on Monday October 26, 2015 @10:44PM (#10455950)

This approach is rather interesting. But I'm wondering whether a similar attack could be made by placing links on a web page and using the CSS :visited selector to change the style of visited web pages. Couldn't you then check which links have that formatting and which don't via JS?

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by bzbarsky on Tuesday October 27, 2015 @12:00AM (#10456244)

This used to be possible, but browsers put into place various mitigations: restricting which properties a :visited selector can affect, always computing both the visited and non-visited style to avoid timing attacks, etc. http://dbaron.org/mozilla/visited-privacy has a writeup describing the issues and the solutions that were adopted.

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by mccr8 on Monday October 26, 2015 @10:49PM (#10455966)

You used to be able to do that, but it was fixed in 2010: https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by seanwilson on Monday October 26, 2015 @10:49PM (#10455968)

Yes, this attack was demoed to work several years ago but has been patched as far as I know:

https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...

"The first change is that Gecko will lie to web applications under certain circumstances. In particular, getComputedStyle() and similar functions such as element.querySelector() always return values indicating that a user has never visited any of the links on a page."

[ Parent | on HN ]