New issue
Advanced search Search tips

Issue 889598 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 74987
Owner: ----
Closed: Sep 28
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: ----



Sign in to add a comment

Reveal users browser history by cache

Reported by goo...@tlprod.de, Sep 26

Issue description

PRIVACY ISSUE
You can detect if specific Websites were visited by checking if a resource of the site is already in the browser cache.
This detection can be made via the window.performance data. Very small or zero duration in loading of a resource means it was already in cache and this means the user visited the site.
This works cross domain because the resource.duration attribute is readable from every domain.

VERSION:
Chrome Version: 69.0.3497.100 (Offizieller Build) (64-Bit) Stable
Operating System: Window 10 Home

REPRODUCTION STEPS
1.1 Clear Browser file cache
1.2 Visit demo page
1.3 Verify all outputs say: "You was not on ..."
2.1 Clear Browser file cache
2.2 Visit https://code.jquery.com/
2.3 Visit demo page
2.4 See that it shows "You was on https://code.jquery.com/!"
3. Try it with any of the other samples given.

Note that this reading method only works once for visitng demo page. This is because the demo page loads the checked resources itself which means it produces wrong info on further loads.
To overcome this issue in testing simply clear the browser file cache every time before visiting the demo page.

Demo URL: http://tlpftp.tlprod.de/temp/secprob/secprob.html

I think the privacy problem is clear here. No domain should ever be able to read out your browsing history, not even once.

I hope i will get a reward for this discovery :-)
 
Mergedinto: 74987
Status: Duplicate (was: Untriaged)
Sorry, but cache timing is a well-known issue. This is unfortunately a tradeoff between performance and privacy that has been made in many browsers.

On the web platform side, we're trying to mitigate this by reducing the timing precision. On user side, you can use the Incognito mode as a way to get a fresh cache backend.

Also, your demo doesn't work correctly for me. I have visited some of the listed websites, but it claims that I haven't (until I reload the page, at which point the demo has already populated the cache).

Sign in to add a comment