Feeds

Firefox plans fix for decade-old browsing history leak

'I know where you surfed last summer'

Protecting against web application threats using SSL

Firefox developers say they're close to plugging an information leakage hole that has plagued every major browser for more than a decade.

The cascading style sheets history attack makes it easy for web masters to compile vast lists of links visitors have previously viewed. It exploits technology in virtually every browser that causes visited links to be displayed in purple rather than blue. Mozilla has classified the weakness as a bug since at least 2002.

But fixing it has proved to be a vexing problem, largely because programmers didn't know how to close the hole without breaking key web functionality. Many proposed fixes threatened to bring browsers to a crawl or prevent users from knowing whether they had previously visited a website, trade-offs Mozilla, Microsoft and other browser makers have largely considered unacceptable.

Now, Mozilla security team member Sid Stamm says the hole will soon be closed in the open-source browser in a way that won't sacrifice usability. It incorporates technical changes designed to prevent the three most common attacks based on layout, timing and computed style of links.

"A few websites may look a little different, but visited links will still show up differently colored," he wrote here. "A few sites that use more than color to differentiate visited links may look slightly broken at first while they adjust to these changes, but we think it's the right trade-off to be sure we protect our users' privacy." (Additional technical details are here.)

Web application security expert Robert "RSnake" Hansen wasn't nearly as optimistic. In a blog post he said Mozilla's approach only makes it harder to exploit the weakness, rather than eliminating it.

"So let's not pat ourselves on the back too much here - it seems with every hole fixed there's two more that pop up and even when identified they take way too long to fix," he wrote. "I don't mean to harp on the Mozilla guys too much - at least they have a fix in the works. But that doesn't change the fact that we appear to be playing a very losing game of whack a mole."

It's also worth noting that most of the attacks can be eliminated by blocking a site's ability to run Javascript. That means users of the NoScript add-on for Firefox will in many cases be protected against the attack. Then again, it's getting harder and harder to do anything online without Javascript. Any site that has the ability to run code also has the ability to silently pilfer your browsing history.

And that means the changes by Mozilla are a step in the right direction, even if they don't completely eliminate the problem. Stamm has called on other browser makes to follow suit, which would also be a step in the right direction. The Register has placed queries with Google, Microsoft and Opera Software about their plans and will update this article with any responses. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.