back
93 comments
Throwaway account. My company created an analytics product around the ability to track which sites your visitors have visited. It used a different and (at the time) more reliable technique.

About a year after the product launch we were contacted by a powerful washington based lobby group and they wanted to chat. They felt it violated a site visitor's "reasonable expectation of privacy". I agreed. So we pulled the feature and dodged a bullet as this "browser bug" hit the mainstream press a few months later. The feature wasn't a major part of our product's value prop, few of our customers used it and none missed it.

So if you're thinking about basing a startup on this, don't. You will get a call very quickly from organizations much larger than you are asking awkward questions.

I wonder if they have contacted Facebook about some of their practices, which may be similar?
Related, an advertising company who was accused of tracking history: http://cyberlaw.stanford.edu/node/6695
Open-source it?
Not even close, while all the sites it said I visited, I had, it missed tons of other sites I'd visited.
It said I have not visited any of them, except google (there it just says "whoops", I'm not sure if that is a hit or not).
Same here. Zero false positives, but several false negative results.
Same here. There were 3 correct positives listed, and I had about 7 or 8 false negatives.
I think it got 100% for me, on Safari/Mac.

Note that it doesn't need to be 100% accurate to be effective. If it guesses better than 50% (i.e. coin flip), then it could be used to give guesses with at least some confidence. No different than analyzing any other noisy dataset. Because this all works client-side, it can also be done quite invisibly.

Right, but those applications will be for things like online advertising, which is already tracking your visits and/or just assuming you use the popular sites anyway. Can this be used to violate privacy in a meaningful manner if it misses 50% or more of the time? You'd have complete plausible deniability if you were pinned to have accessed some site you don't want people to know you accessed. It can't be used as evidence in anything. What would the threat look like?
It would have to guess better than anonymous modelling, not 50%. I'd happily bet even odds layout that each of my site visitors visit Google.
there is already way better and reliable methods to accomplish same goal. e.g

http://ajaxian.com/archives/spyjax-using-avisited-to-test-yo...

There's another trick you can use, for detecting if somebody is logged in to certain sites. See:

https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Pri...

Although, the Google test on that page is currently broken. The Facebook and Twitter ones aren't.

Apparently the key to people not knowing where you visited is to use IE. It missed sites like Twitter and Facebook that are open for me all the time. It did get one site correct, HN ;<).
What would be a possible use of this attack? I can't think of anything useful you'd do with knowing that you've visited Facebook. And so many people use sites like Facebook you might get a better success rate just always returning "visited" rather than measuring this way!
Old but related: Using your browser URL history to estimate gender http://www.mikeonads.com/2008/07/13/using-your-browser-url-h...

Seems like i'm 50% male 50% female :D

Nope. Only got 1 right.

Best of luck, it's an interesting concept!

Again, this seems to be inaccurate for a large number of people. Can we take these two attempts as evidence that is hard for malicious websites to discern our browser history?
With the exception of Facebook (which I visited this morning), the results were accurate (Amazon, reddit, linkedin, wikipedia, youtube). Spoooky!
Said I hadn't visited any of the sites, except HN (which is easy to guess since news.ycombinator.com will be in the HTTP_REFERER field...).

If I re-run the test it still gets some sites wrong (says I haven't visited them when in fact I have). It even claims I haven't visited Amazon both times when in fact it's open in another tab.

I just tried it twice, once on a public wi-fi network. And then again when I got home. It worked very well on the public wifi, and had many false positives at home.

It seems to work better on slower internet connections. The script returns calls a site "visited" if the response time of the potentially cached image is less than 1/20 the time of the certainly uncached image.

On slow connections the cache is much faster than the uncached. On fast connections it's only slightly faster. However, the known uncached images sometimes have "10x increase in latency" so it seems that based on my (and other's experience) that this is a major problem.

One could attempt to normalize this for the sites where appending random query string causes higher latency. Simply precalculate the added latency from images with the random query string on a per site basis. Then subtract it from "uncachedTime."

Doesn't appear to guess correctly in Chrome 15 on OS X (10.7.2). I'm not sure exactly what the 'whoops' means for google - but I've obviously visited HN and have visited a few of the others as well.

Screenshot: http://cl.ly/1i0921270W2b1u190b0W

Didn't work on Opera on Linux (said I never visited any of those sites)
RequestPolicy prevents that approach.
the Images :

  facebook: 'https://s-static.ak.facebook.com/rsrc.php/v1/yJ/r/vOykDL15P0R.png',

  twitter: 'https://twitter.com/images/spinner.gif,

  digg:http://cdn2.diggstatic.com/img/sprites/global.5b25823e.png,

  reddit: 'http://www.redditstatic.com/sprite-reddit.pZL22qP4ous.png,

  hn: 'http://ycombinator.com/images/y18.gif,

  stumbleupon: 'http://cdn.stumble-upon.com/i/bg/logo_su.png,

  wired: 'http://www.wired.com/images/home/wired_logo.gif,

  ....
Really interesting concept. This one wasn't as accurate for me as the original Firefox-specifc proof of concept, though. It only picked up on YouTube and Wikipedia. What's with the "whoops" on Google?

I do use NoScript and Ghostery, though, and I could see how that might cause some false negatives.

When the script is run the second time, it will show that every site was visited. After the first visit, guess its cached and cannot figure out if its a hit or a fail :)

Running in Chrome's incognitive mode is a bit different though. only 7 show up cached the first time its run.

It said "not visited" for EVERYTHING, except google which says "whoops". I have visited nearly all of them in the last 2 months.

But don't despair, I have one of the most hostile browser settings. I have RequestPolicy, NoScript,and Flashblock.

Interesting concept, but I'm quite certain that I haven't only been on xkcd.

http://dispatched.ch/pic/visipisi-20111203-214939.jpg

Mostly right for me except it didn't know I visited twitter and facebook (both tabs are open right now).

That's probably due to me blocking facebook and twitter widgets on sites other than Fb and twitter though.

In my case, the ones it got wrong were the images that returned a 304 (not changed) header since they returned significantly faster than fetching the full image.
It said no to sites I had visited. Unless that is what is was programmed to do I'd say it did not work. You can message me for any other info about the test.
From the 5 sites I visited, it correctly flagged HN, WP and YT as visited, and gave a "whoops" for FB and Google (what does that mean?), which I both visited.
I got extremely inconsistent answers on multiple runs.
No, you don't. One false positive, many woops, quite a few false negatives. After calling the script a second time, almost all guesses are wrong.
Apparently I haven't visited HN. :)

I wonder if the use of ghostery, no-script, that sort of thing, is what bamboozles it? Overall, it looks like it's guessing.

Completely wrong. Said I visited some I haven't heard of, whooops on Google, and not visited on most of those that I've been to recently.
It got all of them right for me (Chrome, Windows XP) except for twitter. I got a "whoops" for google multiple times.
Big miss for Twitter, but cool idea anyway.
The results are not consistent. Each time I click the button it keeps changing and also lists the wrong sites.
It only got 4 out of 15 correct for me.
It says I've visited HN and Slashdot. I haven't been to slashdot this year, but I did go to facebook...
Dead on for me. Chrome under Ubuntu.
Did not work at all for me. The other one had slightly better results. Win 7 on most recent FF.
Got only 1 for me- youtube.

Several others it said I didn't visit but I did.

And it said I visited linkedin, and I didn't.

Interesting. Twitter and HN yes, Facebook and LinkedIn no. Chromium on Debian.
I'm on Firefox 9.

For all the entries I got "not visited", even though I visit a lot of them.

Extremely wrong on Chrome. The first time I ran it, it said I had not visited any of them. Google and HN were definitely browsed today.

Ran it again, ALL of them appeared visited. Even sites like abebooks, which I have not visited at all.