How I recorded user behaviour on my competitor’s websites

Re:How I recorded user behaviour on my competitor’s websites by yashap on Thursday August 23, 2018 @12:05PM (#17828385)

Another possibility - if the referring page is a different domain, overriding back is ineffective (the browser just does a “real” back in these cases).

[ Parent | on HN ]

Re:How I recorded user behaviour on my competitor’s websites by Ajedi32 on Thursday August 23, 2018 @12:35PM (#17828619)

I don't understand. Are you suggesting that if you arrive at a site from Google, the history API should just not work?

For example, let's say a user arrives at a single-page application from Google, and clicks a link on that page to get more information. The site adds a history entry with pushState, but doesn't reload the entire page. Are you saying that in this case, when the user clicks back they should get sent back to Google instead of to the site's home page? If so, that seems like rather unexpected behavior. And if not, isn't the attack still viable?

[ Parent | on HN ]

Re:How I recorded user behaviour on my competitor’s websites by yashap on Thursday August 23, 2018 @04:00PM (#17830260)

Hmm touche, this wouldn’t fix much

[ Parent | on HN ]

Re:How I recorded user behaviour on my competitor’s websites by 3pt14159 on Thursday August 23, 2018 @09:02PM (#17831979)

No; you were right. The browser needs some AI to be smarter but this is all still possible.

[ Parent | on HN ]