• Categories

  • Archives

    « Home

    EWeek: Popular Websites Sniff Browser History, Researchers Find

    EWeek takes a look at “An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications” (pdf), a report from researchers at the University of California-San Diego on the practice by some Web sites of “sniffing” a site visitor’s browser history in order to track that person’s online activity.

    In a paper titled “An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications” (PDF), the group detailed their analysis of Alexa’s global top 50,000 Websites, which they performed with a modified version of the Google Chrome browser. What they discovered is that 485 of the sites are capable of inferring browser history data, 63 of which are transferring that data to their network. In addition, 46 sites were actively participating in history sniffing. […]

    Essentially, attackers trying to sniff histories insert invisible links into Web pages and use JavaScript to inspect certain style properties of the links, such as the color field, to determine whether or not someone has visited a particular URL, the researchers explained. Web analytics firms Tealium and Beencounter sell services that allow a Website to collect the browsing history of their visitors using history sniffing, the report notes.

    Some of the sites revealed to be performing history sniffing include, and, according to the report. A complete list of sites is contained with the report linked to above. […]

    The latest versions of Apple Safari and Google Chrome are not vulnerable to this kind of history sniffing, and Mozilla has a fix slated for Firefox 4.0, [said Ranjit Jhala, co-author of the report.] […]

    “I was surprised that so many popular and mainstream sites actively gather this kind of information which I would consider somewhat personal,” Jhala said of the history sniffing. “One analogy is say, I walk into a Banana Republic store and am told by the salesperson that they’ve been monitoring me and know I have recently visited the Gap, J Crew, CVS, Trader Joes and so on. Perhaps the bigger surprise was that there is an entire industry that has grown around this practice—behavioral analytics. That said, perhaps this was inevitable, as advertising is what makes the Internet go round.”

    Leave a Reply