Re: Stealing browser history without JavaScript

To: or-talk@xxxxxxxxxxxxx
Subject: Re: Stealing browser history without JavaScript
From: Kyle Williams <kyle.kwilliams@xxxxxxxxx>
Date: Sat, 13 Jun 2009 15:25:22 -0700
Delivered-to: archiver@xxxxxxxx
Delivered-to: or-talk-outgoing@xxxxxxxx
Delivered-to: or-talk@xxxxxxxx
Delivery-date: Sat, 13 Jun 2009 18:25:25 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=KwoGH4UUikmfl+SfDMkJQqTTD9rCfkhitjPlNRpPnUE=; b=ceCmX9ibLVN0GtCJGtkAxjjsX1zxfkDrt6S8TVsZfTKb17XE+ltRXmehp9D3thP/z1 QDD1VA4BXev5ch+04hubhw43xtbvUld7HeCeeAMi2fcQdL7QA3B7gGMAg7U/t5WnPnxl 56XFHMHD5aUJMiJWOGonyMxcGajhLTteseoio=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=opRR+a4W4rujPaNBAGDenfQ+80b6yJC6x4ovobmtPOu6cnoWjMdRJKVrZsgTRXJJgu G7T0uA3OzV28PSWG12Hpc5FOWsxkoRKvbcOa2+ZdPyvzxN17aoi0WJrKskSApTkRAq/n HKfUAoUoVtQSE49+2D72JmjPw8M2xLwCoK5XQ=
In-reply-to: <4A340E49.8090403@xxxxxxxxx>
References: <4A340E49.8090403@xxxxxxxxx>
Reply-to: or-talk@xxxxxxxxxxxxx
Sender: owner-or-talk@xxxxxxxxxxxxx

This is using the CSS history trick to figure out where you've been.

This has been around for awhile now.

2009/6/13 Matej Kovacic <matej.kovacic@xxxxxxxxx>

Hi,

this seems an interesting issue:

http://www.making-the-web.com/misc/sites-you-visit/nojs/

bye, Matej

References:
- Stealing browser history without JavaScript
  - From: Matej Kovacic