[Ward]

AP Technology Writer Jordan Robertson's article, Secretly visited porn? Some websites use browser flaw to expose where you've gone, hit the Internet last Sunday. The attention-grabbing title misses the focus of the report, harvesting browser histories of all visited sites. It's not just porn sites we should be concerned about.

From the article: "Current versions of the Firefox and Internet Explorer browsers still allow this, as do older versions of Chrome and Safari, the researchers said."

Does OmniWeb include the history sniffing protection like the latest releases of Chrome and Safari?

-- Ward

[submitted as formal feedback]

[dave_m]

This article has been making the rounds this week, but I haven't seen a link to a demonstration of the method, or information about which versions of WebKit older than the current Safari and Chrome shipping versions are affected. For what it's worth, the OmniWeb 5.11 sneaky peeks do include a more recent webkit version than 5.10.3.

[Ken Case]

I haven't tested whether any specific version of OmniWeb is vulnerable to history sniffing, but it appears the technique used is to load up an invisible inline frame with a bunch of links and then test whether the links are rendered with the visited CSS property.

I'm not sure what specific steps Chrome and Safari have taken to block this, but I'm guessing that they disabled JavaScript's access to the CSS properties used to sniff out the visited status; if so, those fixes would be in the latest shipping WebKit which is now in OmniWeb 5.11.

(I haven't explored this, but it seems like it would be hard to solve this generally without blocking a lot of JavaScript/CSS functionality. For example, even if you can't access the visited state directly, you could presumably still use CSS to set the visited font size to something which would affect page layout, then inspect the layout to see whether a link was visited. Maybe that's still a vulnerability in Safari/Chrome, or maybe they've addressed this somehow?)

I should point out that OmniWeb lets you delete specific history items whenever you wish, which will defeat any sort of history sniffing: show your history (using History->Show History), select the items you wish to delete, then press the Delete key.

[whpalmer4]

A bit off the original track, but if you have a specific site you want to visit that you fear might do history sniffing, you could use Fluid to make a site-specific browser. First came disposable email addresses, now disposable browsers!