Feeds

Firefox plans fix for decade-old browsing history leak

'I know where you surfed last summer'

Top 5 reasons to deploy VMware with Tegile

Firefox developers say they're close to plugging an information leakage hole that has plagued every major browser for more than a decade.

The cascading style sheets history attack makes it easy for web masters to compile vast lists of links visitors have previously viewed. It exploits technology in virtually every browser that causes visited links to be displayed in purple rather than blue. Mozilla has classified the weakness as a bug since at least 2002.

But fixing it has proved to be a vexing problem, largely because programmers didn't know how to close the hole without breaking key web functionality. Many proposed fixes threatened to bring browsers to a crawl or prevent users from knowing whether they had previously visited a website, trade-offs Mozilla, Microsoft and other browser makers have largely considered unacceptable.

Now, Mozilla security team member Sid Stamm says the hole will soon be closed in the open-source browser in a way that won't sacrifice usability. It incorporates technical changes designed to prevent the three most common attacks based on layout, timing and computed style of links.

"A few websites may look a little different, but visited links will still show up differently colored," he wrote here. "A few sites that use more than color to differentiate visited links may look slightly broken at first while they adjust to these changes, but we think it's the right trade-off to be sure we protect our users' privacy." (Additional technical details are here.)

Web application security expert Robert "RSnake" Hansen wasn't nearly as optimistic. In a blog post he said Mozilla's approach only makes it harder to exploit the weakness, rather than eliminating it.

"So let's not pat ourselves on the back too much here - it seems with every hole fixed there's two more that pop up and even when identified they take way too long to fix," he wrote. "I don't mean to harp on the Mozilla guys too much - at least they have a fix in the works. But that doesn't change the fact that we appear to be playing a very losing game of whack a mole."

It's also worth noting that most of the attacks can be eliminated by blocking a site's ability to run Javascript. That means users of the NoScript add-on for Firefox will in many cases be protected against the attack. Then again, it's getting harder and harder to do anything online without Javascript. Any site that has the ability to run code also has the ability to silently pilfer your browsing history.

And that means the changes by Mozilla are a step in the right direction, even if they don't completely eliminate the problem. Stamm has called on other browser makes to follow suit, which would also be a step in the right direction. The Register has placed queries with Google, Microsoft and Opera Software about their plans and will update this article with any responses. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.