The My Opera forums have been replaced with forums.opera.com. Please head over there to discuss Opera's products and features

See the new Forums

Security Update required: Opera reveals history to server

Forums » General Opera topics » Security and privacy in Opera

You need to be logged in to post in the forums. If you do not have an account, please sign up first.

Go to last post

27. October 2011, 03:39:05

xd3sclu

Posts: 47

Security Update required: Opera reveals history to server

Check this:
http://xd3sclu.x10.mx/history_check/
Enter URL you have visited before, and it will find it out whether you have visited it before or not.
This test failed in Firefox and Google Chrome, while server can still track Opera users. The method it uses is to load different background-image for normal link and a:visited css selector, without any need of javascript. (I have made the page just to test it. It doesn't store anything on server, feel free to test.)
Opera/9.80 (J2ME/MIDP; Opera Mini/6.5.26955/26.1036; U; en) Presto/2.8.119 Version/10.54
Opera/9.80 (Windows NT 5.1; U; Edition Next; en) Presto/2.9.220 Version/12.00

27. October 2011, 04:15:42

Moderator

sgunhouse

Volunteer

Posts: 66788

Mind you, it is up to you whether or not you pass that test ... there is a setting to make it so websites can't detect your history.

27. October 2011, 04:17:13

xd3sclu

Posts: 47

Setting please?
Opera/9.80 (J2ME/MIDP; Opera Mini/6.5.26955/26.1036; U; en) Presto/2.8.119 Version/10.54
Opera/9.80 (Windows NT 5.1; U; Edition Next; en) Presto/2.9.220 Version/12.00

27. October 2011, 06:42:23

Moderator

sgunhouse

Volunteer

Posts: 66788

See http://my.opera.com/community/forums/findpost.pl?id=7911862

Took a while to find as it's a fairly old topic now ... there's a setting in opera:config named "Visited Link State"; as mentioned in the linked post you can set it to either 0, 1 or 2 (with 2 being the normal setting).

Keep in mind, the setting actually changes how Opera displays visited links. If you set it to 0, Opera will not indicate any links as visited; set it to 1 and only links within the same domain are marked as visited. So it depends on how thorough you choose to be. Since I'm lucky to have Opera remembers pages I've visited more than 24 hours ago, I don't worry about this setting ...

27. October 2011, 07:00:54

xd3sclu

Posts: 47

@gdveggie Understood. Thanks.

@sgunhouse It's good thing that there's way, but there are two problems:

1. Not all Opera users know that.
2. User can't find out whether he/she has visited link before or not, because the color never changes. Firefox/Chrome prevents it by not allowing getComputedStyle on those links.
Opera/9.80 (J2ME/MIDP; Opera Mini/6.5.26955/26.1036; U; en) Presto/2.8.119 Version/10.54
Opera/9.80 (Windows NT 5.1; U; Edition Next; en) Presto/2.9.220 Version/12.00

6. November 2011, 05:08:33

spadija

Posts: 1643

I don't see how disabling getComputedStyle prevents you from using that method. You could simply make the links visible but offscreen or hidden behind something, set the font size (or some other size property) of visited links to something larger than normal, and then check the element's offsetHeight/Width. If the element is bigger than normal, it's visited. Completely disabling :visited is the only way I see to prevent someone from scanning your history with it.

27. January 2012, 08:34:48

gdveggie

(Arcimboldo's "The Gardener" - ca 1590)

Posts: 1710

Saw your other thread and I'm just posting here to get this new one on my subscription list. Don't know enough about it to contribute, but I'm curious about what others might have to say.

Forums » General Opera topics » Security and privacy in Opera