Issue metadata
Sign in to add a comment
|
Reveal users browser history by cache
Reported by
goo...@tlprod.de,
Sep 26
|
||||||||||||||||||||||
Issue descriptionPRIVACY ISSUE You can detect if specific Websites were visited by checking if a resource of the site is already in the browser cache. This detection can be made via the window.performance data. Very small or zero duration in loading of a resource means it was already in cache and this means the user visited the site. This works cross domain because the resource.duration attribute is readable from every domain. VERSION: Chrome Version: 69.0.3497.100 (Offizieller Build) (64-Bit) Stable Operating System: Window 10 Home REPRODUCTION STEPS 1.1 Clear Browser file cache 1.2 Visit demo page 1.3 Verify all outputs say: "You was not on ..." 2.1 Clear Browser file cache 2.2 Visit https://code.jquery.com/ 2.3 Visit demo page 2.4 See that it shows "You was on https://code.jquery.com/!" 3. Try it with any of the other samples given. Note that this reading method only works once for visitng demo page. This is because the demo page loads the checked resources itself which means it produces wrong info on further loads. To overcome this issue in testing simply clear the browser file cache every time before visiting the demo page. Demo URL: http://tlpftp.tlprod.de/temp/secprob/secprob.html I think the privacy problem is clear here. No domain should ever be able to read out your browsing history, not even once. I hope i will get a reward for this discovery :-) |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by msramek@chromium.org
, Sep 28Status: Duplicate (was: Untriaged)