Your interests are: (some subset of) Programming Science Technology Games <random other thing: Sports, TV, childcare, etc>
With literally no scripting, and everyone would find it "reasonably accurate" :D
Me being me, I clicked on random grey squares. I got exactly that.
There is a selection bias from the choice of URLs it provides.
I an a bit disappointed by the results anyway. Something like gender guess, sexual orientation, age range and political leaning would have been more impressive than the programming/movies graph.
Somebody else clicked all of the squares, and art was #1, with painting #3.
So this nice "Who am I?" trick only shows an intersection of my interest with those of the author. e.g. its completely missing my 3 main hobbies, as sailing, sewing and vaping had not been on his list of selected sites.
1. science 2. technology 3. programming
And it was dead-right.
WHAT KIND OF SORCERY IS THIS!?
1.Technology 2.Gaming 3.Programming
1. technology
2. movies
3. books
4. programming
5. science
6. politics
7. gaming
Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?
I don't see any secure way to handle this besides disallowing :visited styling entirely.
It's a good example of just how difficult browser security is.
The most promising workaround would be to find a JS screenshot tool that doesn't rely on the DOM, and then run some client-side image analysis to get the index values of the red squares, and then go from there to click the things. Well played, exploit fixers, well played.
I know that the `:visited` exploit is handled by the browsers so that you can't figure out by javascript what is going on...
but what if you used just CSS to figure it out? For instance, what if you generated the CSS which had a unique image it requested via the `background-image` property, stored the data on the server, then just requested the data from the server after the fact?
Do the browsers prohibit the usage of url-based css properties on CSS selectors with `:visited` or something? Does anyone have a link/reference to how the exploits were patched up?
[0]: https://hacks.mozilla.org/2010/03/privacy-related-changes-co...
Documentation of the game proof-of-concept: http://lcamtuf.blogspot.com/2013/05/some-harmless-old-fashio...
I can answer any questions people have.
The hundreds of grey boxes that you see are actually links to sites belonging to different categories like programming, science etc. and the red ones are those that you have visited (based on your browser history). The basic idea here is of using the CSS selector a:visited to highlight visited links in red, and by clicking the red boxes the users themselves reveal the sites they have visited. The website then uses this information to draw a pretty pie chart showing which categories the user is interested in.
Kinda weird.
Otherwise, there's always sites like http://pro.jsonlint.com/
And the only reason you have to click the red squares is to let it know which ones are red. If you try to look up the color of a square using GetComputedStyle, it always comes back gray. That was the resolution of privacy Bug 147777† (":visited support allows queries into global history").
for(i=0;i<$$('a').length;i++) {
$$('a')[i].click()
}This web-app's functionality is based entirely on browser history and has nothing to do with 're-marketing cookies' or other 'markers'.
Not to mention that the parent commenter clearly understood this fact.
This works by showing you a grid, each box represents a website, to which the creator has ascribed a category(tech/gaming/etc...)
If you've visited one of those sites the box will appear red, and by clicking on the box you let the site know that it is something you've visited in the past and therefore likely one of your interests.
https://media.blackhat.com/us-13/US-13-Stone-Pixel-Perfect-T...
The related bug on the Chrome tracker was closed with a "won't fix".
And also note that this will remove all :visited styling, included the usual blue->purple. Just a heads up for people changing this variable because they think their privacy is being invaded.
https://hacks.mozilla.org/2010/03/privacy-related-changes-co...
Basically, the website doesn't know which of the squares are red, that depends on your browser state. By clicking the red squares, you're feeding it data.
The interesting observation I made out of this is that navigating there in an incognito window prevents any links from being considered as visited. That's good to know.
It's quite interesting to see how such a seemingly simple feature (a:visited) can completely override user privacy if not accounted for.
At first I thought it would deduct information about me by analysing which squares I'd choose in what order and through other metrics like pacing.
Indeed I am unhackable.
Accuracy varied a lot between computers but in ideal circumstances (only browser running) it would have ~90% accuracy on each of 25 links I was testing against - the test took about 8 secs to run though.
Interestingly it never worked particularly well in chrome - chrome seemed to stop painting :visited elements after a certain amount which prevented it from working.
I just pushed an update that added more topics and graphs. I have had reported problems after the update. Can anyone confirm?
see on github: https://github.com/Conlectus/WhoAmI/blob/master/css/main.css
Fun experiment !