It does not require js to work. In essense, it uses css styles to exploit visited links.

I had to enable js for it to work in firefox

Also, lying the visited state on JS was implemented as early as Firefox 4 - so it is definitely not a JS-dependent "exploit" (rather, it's a rather oblique way of social engineering).

But dont you need js to check for the styles to see if the link is visited?

No, each square the user clicks could be a checkbox that is submitted to the backend as a form when they click done.

It could even just use CSS selectors to reveal an image or change a background image that results in a request to the backend.

Fortunately most browsers already have some measures to prevent that (https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...), the demo avoids automating the process altogether, and relies on tricking the visitor into 'voluntarily' telling if they've visited a site.

I meant you can use CSS on the checkbox once it is checked, there is no need to actually submit a form. I understand that you can't use CSS directly on the :visited selector.

Ah I see, that makes sense.

You need js to extract the PI though?

JS or user submitting a form -- some form of client interaction.

You can do requests to the site using pure CSS as well, using something like `.site:visited { background-image: url(/logging/site); }`

those kind of tricks are already blocked by browsers, as the article explains

This one does not really need JS, the captcha could be done with an HTML form and checkboxes.

captchas which are not working with noscript/basic (x)html browsers are definitive no-no anyway.