CSS Leak Provides a Sneaky Approach to Per-User Customization
You’ve been seeing already-visited links turn a different color from unseen ones so long that you probably don’t think about it. Interestingly, Aza Raskin points out, CSS does think about it.
By programmatically looking at the style of links your browser is displaying, a JavaScript script can tell which are purple and which blue; and hence where your browser’s been!
A new script called SocialHistory.js exploits that little information leak in the service of good. Eyeball-hungry blogs, including the Wired.com family, have a bad habit of barraging the user with iconified demands: “Digg this! Reddit this! StumbleUpon this! Simpy this!”
SocialHistory.js pulls up a hidden iframe in order to sniff which, from a checklist of 30+ social-bookmarking sites, a user has visited. Armed with a JavaScript array of that information, site designers can limit their arsenal of steenking badges to a customized couple that each user may find helpful.
Of course this CSS discovery trick has a million other possible uses, just waiting to be exploited. Meanwhile, it’s an open Mozilla bug, which may be stamped out before it becomes widely used as a scripting technique.
