Your browser logs whatever pages you visit in browser history and most users think that it’s pretty much private because nobody else gets to see what pages you’ve been visiting, but that turns out to be false. I just came across Spyjax (via Mashable!) which shows your full browser history.
Spyjax extracts your browser history by exploiting the simplest feature of all, which is changes the color of links for sites you’ve visited. A simple piece of javascript should be good enough to determine the color of these links inorder to determine the sites visited by you, however, this can’t determine your entire browser history, because it needs a predefined list of URLs to test. Using AJAX, it’s not a problem at all… tons of URLs can be tested within seconds.
The only limitation is that this technique cannot scrape directly your browser history; it needs to test a predefined list of URLs to see if you’ve visited any of them.
Sounds pretty scary, but you can prevent this from happening by either disabling javascript in your browser all together or by limiting (or disabling) your browser history.
Optionally, you can also have fun by placing their widget on your web page and show your readers whatever sites they’ve been visiting. I’m not sure, if they’ll be happy about this, but they’ll pretty much be blown off. How good is this from Google Web History?
Discussion
Comments for “Spyjax: Your browse history is not private!”