<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
<br>> Date: Sun, 14 Jun 2009 22:34:32 +0100<br>> From: my.green.lantern@googlemail.com<br>> To: or-talk@freehaven.net<br>> Subject: Re: Stealing browser history without JavaScript<br><br>> > Matej Kovacic wrote:<br>> ><br><br>> > Seems to me it would have to have all websites known to man on the page it<br>> > loads. If it looks at "visited links" css on the page it loads it could<br>> > only look at websites on that page. It would have to store a lot of web<br>> > pages on that hidden i-frame to really compare. Unless you are looking to<br>> > see if a particular person visited a particular page doesn't seem like it<br>> > would do anyone much good.<br><br><br>There are 50000 URLs used: they are loaded into the Iframe 2000 at a time.<br>e.g. http://www.making-the-web.com/misc/sites-you-visit/nojs/base.php?sess=xxxxx&from=49000<br>But yes it wuld be more useful for breaking the anonymity of a particular person who you had a known unique URL for.<br><br>><br>> Zinco wrote:<br>> In this IFrames exploit the test web page is said to have a css<br>> background image embedded in it. I can find no such image (background:<br>> #003399;).<br>> (See http://www.w3schools.com/css/pr_background.asp.)<br><br>The links each have their own style statement and a background called from log_base.php<br>e.g. #l49871 a:visited{background:url(log_base.php?id=49871&sess=xxxxx);<br><br><br /><hr />Windows Live™ SkyDrive™: Get 25 GB of free online storage. <a href='http://windowslive.com/online/skydrive?ocid=TXT_TAGLM_WL_SD_25GB_062009' target='_new'>Get it on your BlackBerry or iPhone.</a></body>
</html>