undefined | Better HN

0 pointsirises_come12y ago0 comments

I presumed as much. But if you can covertly jimmy the UI and parse the user's interaction, you can more or less get at the history like that anyway.

I don't see any secure way to handle this besides disallowing :visited styling entirely.

0 comments

4 comments · 2 top-level

chc12y ago· 2 in thread

I'm having a hard time following here. What is "covertly jimmying a UI" and how would it allow you to exploit visited styles?

gburt12y ago

For a less "covert" example than I am sure the OP was thinking, you could have "click the red button to continue" sort of like this page does. :)

eli12y ago

Wouldn't that also require a hundred same sized differently colored buttons, just like this site?

2 more replies

SahAssar12y ago

It's surprisingly hard to do. Since the allowed styling does not affect positioning in any way (you used to be able to change the font-weight, but not anymore) and the browser removes all :visited styling for client side html-image libraries such as html2canvas you need to generate a massive amount of clicks from the user or have them targeted only to visited elements such as this page does.

j / k navigate · click thread line to collapse