[thelist] Interesting new Browser history sniffing trick

[Mark Groen]

On Tue, 2006-22-08 at 22:19 +0100, Lee kowalkowski wrote:
> On 22/08/06, Christian Heilmann <codepo8 at gmail.com> wrote:
> > Now, Jeremiah Grossman found a way around that:
> > http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html
> 
> Very nice indeed, but not *quite* finding a way to get the URLs out of
> the browser window (session) history.
> 
> This lists hand-picked URLs that the user has visited since the
> relevant cache was cleared / purged, but depending on the attacker's
> goal, this is even better, because it has a higher chance of
> qualifying a victim.
> 
> 1/ Detect customer of banking corp.  2/ Display interesting article
> containing a link to the said bank about anything that would encourage
> the reader to follow it, e.g. Free MP3 player if you're current
> balance ends in ".93".  3/ Present fake/proxy login page.
> 
> Scary.

Must be a Windows thing, no history of where I've been is showing in the
"I know where you've been" area using Firefox and Fedora, and there's
oodles of items in todays history cache...

-- 
cheers,

        Mark