…and this is a 
Those porn sites you've been browsing? They've been slurping in more of your private data than you think. A paper has been published documenting the invasive practices of many websites. They're doing something called history hijacking, using code that grabs your entire browsing history so they can monitor every site you've visited. Cute, huh? There are tools you can use to block this behavior if you're using Firefox, at least.
Several people have written to me about this because of Table 1 on page 9 of the paper. There among the porn and gaming and commercial sites one stands out as unusual. It's the only site with the category of "religion".
It's Answers in Genesis.
Yep, don't be surprised. Answers in Genesis wants to know where you've been.
Even better, a reader named Ivan extracted the sleazy history hijacking code from the AiG site. Wanna see it? It's actually rather amusing. I've put it below the fold.
Here's what's funny. They categorize users.
$(document).ready(function() {
var cookie = $.cookie('__utmv');
$("body").append("<div id='statExternalLinks' style='display:none'>" +
// WEB2.0 USERS
"<a href='http://del.icio.us/'>delicious</a>" +
"<a href='http://docs.google.com/'>googledocs</a>" +
"<a href='http://www.digg.com/'>digg</a>" +
"<a href='http://www.stumbleupon.com/'>stumbleupon</a>" +
"<a href='http://www.twitter.com/'>twitter</a>" +
// COMMUNITY USERS
"<a href='http://www.facebook.com/'>facebook</a>" +
"<a href='http://www.myspace.com/'>myspace</a>" +
"<a href='http://www.secondlife.com/'>secondlife</a>" +
// CREATIONIST GROUPIES
"<a href='http://www.icr.org/'>icr</a>" +
"<a href='http://www.drdino.com/'>drdino</a>" +
"<a href='http://creationontheweb.com/'>cmi</a>" +
"<a href='http://creationresearch.org/'>crsq</a>" +
// EVOLUTION NEWS FOLLOWERS
"<a href='http://www.newscientist.com/'>newscientist</a>" +
"<a href='http://www.sciam.com/'>sciam</a>" +
"<a href='http://scienceblogs.com/'>scienceblogs</a>" +
"<a href='http://scienceblogs.com/pharyngula/'>pzmeyer</a>" +
"<a href='http://www.talkorigins.org/'>talkorigins</a>" +
"<a href='http://www.richarddawkins.net/'>dawkins</a>" +
"<a href='http://www.ncseweb.org/'>ncse</a>" +
// ID FOLLOWERS
"<a href='http://www.uncommondescent.com/'>uncommondescent</a>" +
"<a href='http://www.evolutionnews.org/'>evonews</a>" +
// MEDIA JUNKIES
"<a href='http://www.youtube.com/'>youtube</a>" +
"<a href='http://www.godtube.com/'>godtube</a>" +
"<a href='http://www.flickr.com/'>flickr</a>" +
"<a href='http://picasaweb.google.com/home'>picasa</a>" +
"<a href='http://www.vimeo.com/'>vimeo</a>" +
"<a href='http://www.hulu.com/'>hulu</a>" +
"<a href='http://www.apple.com/trailers'>movietrailers</a>" +
// ONLINE SHOPPERS
"<a href='http://www.amazon.com/'>amazon</a>" +
"<a href='http://www.ebay.com/'>ebay</a>" +
"<a href='http://www.craigslist.org/'>craigslist</a>" +
"<a href='http://www.barnesandnoble.com/'>barnesnoble</a>" +
"<a href='http://www.walmart.com/'>walmart</a>" +
"<a href='http://www.target.com/'>target</a>" +
// "CHRISTIAN" USERS
"<a href='http://www.gty.org/'>macarthur</a>" +
"<a href='http://www.sermonaudio.com/'>sermonaudio</a>" +
"<a href='http://www.christiananswers.net/'>christiananswers</a>" +
"<a href='http://www.biblegateway.com/'>biblegateway</a>" +
"<a href='http://www.focusonthefamily.com/'>focus</a>" +
"<a href='http://www.pluggedinonline.com/'>pluggedin</a>" +
"<a href='http://www.coralridge.org/'>coralridge</a>" +
"<a href='http://www.crosswalk.com/'>crosswalk</a>" +
"<a href='http://www.oneplace.com/'>oneplace</a>" +
"<a href='http://www.visionforum.com/'>visionforum</a>" +
"<a href='http://www.christianitytoday.com/'>ct</a>" +
"<a href='http://www.castingcrowns.com/'>castingcrowns</a>" +
// KIDS USERS
"<a href='http://www.webkinz.com/us_en/'>webkinz</a>" +
"<a href='http://www.bigideafun.com/'>veggietales</a>" +
"<a href='http://www.cartoonnetwork.com/'>cartoonnetwork</a>" +
"<a href='http://www.qubo.com/'>qubo</a>" +
"<a href='http://www.lego.com/'>lego</a>" +
"<a href='http://mln.lego.com/en-us/privateview/default.aspx'>mylego</a>" +
"<a href='http://disney.go.com/index'>disney</a>" +
"<a href='http://disney.go.com/mypage/'>mydisney</a>" +
"<a href='http://www.clubhousemagazine.com/'>clubhouse</a>" +
"<a href='http://www.whitsend.org/'>whitsend</a>" +
"<a href='http://www.cbhministries.org/home.php'>cbh</a>" +
"<a href='http://kids4truth.com/'>kids4truth</a>" +
// OTHER
"<a href='http://www.creationmuseum.org/'>museum</a>" +
"<a href='http://www.wired.com/'>wired</a>" +
"<a href='http://en.wikipedia.org/'>wikipedia</a>" +
"<a href='http://www.joelosteen.com/'>joelosteen</a>" +
"<a href='http://www.beliefnet.com/'>beliefnet</a>" +
"</div>");
var userVars = '';
if (cookie != undefined) userVars = cookie.split(".")[1];
$("#statExternalLinks a").each(function() {
var curSite = $(this).text();
var color = $(this).css("color");
if (userVars.indexOf(curSite) == -1 &&
(color == "rgb(130, 129, 207)" ||
color == "#8281CF" ||
color == "#8281cf")) {
if (userVars.length > 0) userVars += "|";
userVars += curSite;
}
});
$("#statExternalLinks").remove();
pageTracker._setVar(userVars);
});
Here are the categories they used:
WEB2.0 USERS
COMMUNITY USERS
CREATIONIST GROUPIES
EVOLUTION NEWS FOLLOWERS
ID FOLLOWERS
MEDIA JUNKIES
ONLINE SHOPPERS
"CHRISTIAN" USERS
KIDS USERS
OTHER
We're "Evolution News Followers". They flag you if you have also been reading New Scientist, SciAm, Scienceblogs, TalkOrigins, or the NCSE site, and two people get special attention: that rascal Dawkins and some guy named pzmeyer. So I'm sorry, but if you skedaddle on over to AiG after reading this, you're going to get labeled as one of those pzmeyer people.
I'm a little curious about the '"Christian" Users' category. Why are the Christians in quotation marks? Aren't they real Christians? But then Joel Osteen and Beliefnet get lumped into "Other".
I have no idea what they are doing with this information. If it were a porn site, I could understand it; when Ken Ham visits, for instance, they can scan his history and see what kind of preferences he has, and know to quickly entice him with pictures of naked piglets. But on AiG? Could they be using it to hide the really crazy stuff from people known to associate with Dawkins and pzmeyer? Maybe. I'm going to have to install the blocking tools and see what happens.
I'm a bit afraid that it will be like putting on the sunglasses in that Roddy Piper movie, They Live. Do I really want to see the unfiltered AiG?
Technology
Comments
Posted by: Andyo
|
December 2, 2010 10:49 PM
Yay, at the risk of sparking another browser fanboy war, there's always a tool to block any behavior with Firefox. So I don't mind much when it's using 500 MB of RAM (!).
Posted by: rogue74656
|
December 2, 2010 10:51 PM
Run IE and Firefox simultaneously and look at the site...see if there is a difference....
How about F***ing with their classification and visiting a listed site and then going to AiG? Just like Pharyngulating a poll!!!!!
Posted by: formosus
|
December 2, 2010 10:54 PM
"I came here to chew bubble gum and kick ass. And I'm all out of bubble gum"
Sorry, couldn't resist. But this:
Gives me the impression that the higher ups at AiG (or possibly just this coder) take a rather cynical view of their audience. Could it be that they're just using religion as an easy way to make a buck off the rubes? Perhaps their section of arguments that creationists shouldn't use is intended to keep the movement alive (and money flowing) as long as possible.
Posted by: Mattir-ritated
|
December 2, 2010 10:57 PM
Funny how the creationists are groupies but we're news followers. And how are the groupies different from Christians, anyway?
Posted by: Shadowbright
|
December 2, 2010 10:58 PM
Not compatible with the latest version of Firefox, apparently. :( Oh well.
Posted by: PennyBright
|
December 2, 2010 11:00 PM
Yeah, I'm feeling a coder who's just doing what she's been paid for here, and amusing herself with category labels.
Posted by: Andyo
|
December 2, 2010 11:08 PM
#5, as I said, there's always a way to do anything with FF. The Nightly Tester tools will let you install any add-ons. Most of the current add-ons that give you a version warning work just fine anyway.
That said, I installed this and the options button is greyed out. I don't know if the thing is actually working.
Posted by: ben
|
December 2, 2010 11:09 PM
If you're curious as to how this works:
You know how links are a different color depending whether you've visited that page or not? The defaults are blue for an unvisited link, and purple for a visited one, but the web developer can change those.
This code creates an invisible area on the page and fills it with a list of links. So those links are "rendered" by the browser, but you don't see them -- the area that contains them is hidden. Then it goes through the list of links and checks the "visited" status of each one. It's a very simple trick, really, but has a certain twisted cleverness to it.
Posted by: clare7
|
December 2, 2010 11:10 PM
Anyone know where there might be such blockers compatible with the latest Firefox version?
Posted by: Mike Haubrich
|
December 2, 2010 11:10 PM
For one thing, I didn't even know that "godtube" was still out there. It is so terrible I thought it would be gone in a few weeks of launch.
But, why does a cookie from godtube label one a "media junkie" as opposed to a Christian?
Posted by: Cuttlefish, OM, CR
|
December 2, 2010 11:17 PM
I hate them purely because they *still* (bastards!) show up ahead of me when someone googles "cuttlefish".
This news is merely icing on the hate-cake.
Posted by: llewelly
|
December 2, 2010 11:20 PM
I used the safecache and safehistory extensions for a little while. Then I upgraded firefox, and the extensions don't seem to have been updated yet.
Posted by: yorrike
|
December 2, 2010 11:20 PM
For those wondering, this history hijacking doesn't affect Google Chrome, Safari or other Webkit-based browsers. So if you're using these browsers, you're already protected.
Posted by: Glen Davidson
|
December 2, 2010 11:22 PM
Kids users? Shouldn't these be reported?
And am I an ID follower because I check out IDiot websites to see what they're saying?
Glen Davidson
Posted by: Crazyharp81602
|
December 2, 2010 11:28 PM
Dang! I can't install the add-ons! :( They're not compatible with the latest version of Firefox, which is exactly what I'm using right now unfortunately! Oh well, eventually they'll get it updated and I can be able to install them.
Posted by: Andyo
|
December 2, 2010 11:35 PM
again, you can use the Nightly Tester Tools add-on to bypass the compatibility check. Most add-ons do work regardless of the warning. You can at least test if it works.
Posted by: JohnnieCanuck
|
December 2, 2010 11:41 PM
Tell me more about how they do this. Is there a specific html query for the link visited status or are they running a JavaScript?
Posted by: UXO
|
December 2, 2010 11:45 PM
Andyo@16: ... or, at least, you could, were it not for the fact that Nightly Tester Tools 3.0 is not compatible with the latest build of Firefox....
Posted by: dannyfritz
|
December 2, 2010 11:53 PM
info on the exploit: http://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/
You can install any Firefox extension on any version simply by opening it up with something like WinRAR and modifying install.rdf with notepad to allow it to install on your version.
But besides, they fixed the css:visited exploit in Firefox beta 4
And it can be prevented in ff3.5 and up with about:config Layout.css.visited_links_enabled false
Posted by: jasonmp85
|
December 2, 2010 11:58 PM
@JohnnieCanuck:
This "history hijack" is more like a history probe: you query for sites you're interested in and it tells you whether the user has visited them.
The way it works is by injecting a bunch of links into a part of a webpage for which the author controls styling. The links will be styled differently if they have been visited by the user. The script proceeds to query for the color of each link.
Since the script and styling were written by the same person, they map colors to knowledge about what sites have been visited.
At the end of the snippet the code is only in the browser, though it looks like they're handing it off to some sort of remote call, so they could be collecting it more permanently.
This technique has been used for cooler purposes before: Query for the largest sites whose gender breakdown you know and do some bayesian inference to guess the viewer's gender: http://www.mikeonads.com/2008/07/13/using-your-browser-url-history-estimate-gender/
Posted by: ThirdMonkey
|
December 3, 2010 12:00 AM
Clever.
What they are doing here is adding links to a bunch of sites to the page and making them invisible to you. Then they loop through them and check the color of the link. Visited links have a different color then unvisited. So they are able to tell if you have visited any of the links they have added.
That's all they can tell however.
Then in true creationist/christian fashion they make a bunch of baseless assumptions about who would or wouldn't visit a particular site... ever.
So for example. I would be a evolution news following, community using, online shopping, media junky child who also visits "Other" sites.
Completely useless.
Posted by: jasonmp85
|
December 3, 2010 12:03 AM
Most interesting, perhaps, is whether this sort of probe would be allowed under the new "do not track" idea the FTC proposed today: http://www.ftc.gov/opa/2010/12/dnttestimony.shtm .
Is it tracking? I guess only if you store the data. Good luck to them trying to legislate something so complex.
Posted by: Andyo
|
December 3, 2010 12:05 AM
#18 UXO
LOL, I think you're getting the reverse situation. That version (3.0) is for a future version of FF (4.0). If you're running FF 3.6 you should get 2.0.3.
Posted by: Andyo
|
December 3, 2010 12:08 AM
By the way, it seems to be working here. I'm not getting the previously-visited links highlighted in websites, but at the same time, it disabled my history. It just stopped logging new sites, but the old ones are still there.
Posted by: ThirdMonkey
|
December 3, 2010 12:10 AM
*snicker*
Leave it to a drunk programmer to analyze the code and post before reading any of the other comments...
But what's particularly funny to me is that they left their categorization comments in the code.
Posted by: UXO
|
December 3, 2010 12:14 AM
Andyo@23: HAH! That makes a lot more sense than needing the Nightly Tester Tools installed to allow you to install the Nightly Tester Tools! I was starting to think a Christmas Miracle (TM) would be required! :)
Posted by: Steven Mading
|
December 3, 2010 12:24 AM
The exploit is, begrudgingly, a clever one. No browser writer would be dumb enough to include a feature to let a site query whether or not other sites were visited, but to simply hijack the feature where it colors visited links, and just query for what color they were rendered in, that's pretty clever.
But the obvious question I then have to ask is... why is the browser taking the time to calculate the color of invisible text? Seems like a waste. "I have now determined that this link would have been purple if it wasn't invisible." Perhaps it's because they don't want to go through the effort to calculate that on the fly later on when some other bit of DOM-manipulating Javascript code un-hides the content.
Posted by: Steven Mading
|
December 3, 2010 12:34 AM
PZ said:
It may be true that they do that elsewhere in other code we're not seeing, but that's not what the code you showed us does, PZ.
The only place the code mentions those categories you list is in comment lines ignored by the parser. Take out the comments and you can see the code is performing no categorization of any kind.
(Again, it's possible that there's some code elsewhere that does categorize things like this and the comments are there to remind the programer of that, but from the code you posted, there's no evidence to conclude that's actually going on.)
Posted by: MadScientist
|
December 3, 2010 12:41 AM
Why block the data theft code when you can wipe the history then go visit the pope's website, a dozen or so other religious crazy websites, then visit AiG.
Posted by: Samantha Vimes
|
December 3, 2010 12:49 AM
I wonder who wrote the code.
Evolution news followers, vs. Creationist groupies. Almost like the titles were given to the groups by someone rational. People who follow news sound a lot more thoughtful that groupies, and the term evolution rather than Darwinist or evolutionism suggest an informed party did named them.
Someone on our side was paid to write this by AiG.
I am amused.
Posted by: wmdkitty#83021
|
December 3, 2010 12:49 AM
SafeCache and SafeHistory can both be "tweaked" to work with later versions of Firefox. Instructions are in the comments here
Posted by: Michelle R
|
December 3, 2010 12:50 AM
I think I'll go visit some caveman gay porn website and then go to AIG. That oughta get them creeped out.
Posted by: timepiece
|
December 3, 2010 12:54 AM
Ah yes, that code sure does look evil, with those rows and characters and punctuation and such, but may I direct your attention to this bit here?
ouch! three levels of awesome, right there.
Posted by: A. Nuran
|
December 3, 2010 1:02 AM
Neither tool is compatible with the latest version of Firefox
Posted by:
|
December 3, 2010 1:09 AM
Incorrect. This method is not quite that sinister.
Posted by: https://me.yahoo.com/a/ePZaUQRzp8RTmwJfmvugLekDa4ux#4e32d
|
December 3, 2010 1:15 AM
I hope they enjoy all my porn.
Posted by: CaptainBlack
|
December 3, 2010 1:33 AM
To avoid any but the history you want a site to see being harvested you could always keep a second (or third, or ..) browser, with the history set to be erased every time you exit, specially for the occasions. There are plenty of no-install browser versions that can be kept for this purpose.
There are portable versions of Firefox, Opera and Chrome. These do not need installation and so can cohabit with your usual browser without mutual interference.
CB
Posted by: Menyambal: Making sambal (it isn't dragon magic).
|
December 3, 2010 1:35 AM
Ha-ha! Earlier today I was thinking about commenting that I was trying to keep my browser balanced by opening a porn site in another tab for every tab opened in that silly Ark site, with the punch line that I was having trouble finding porn bad enough to balance it out. Now I will be sure to do that next time.
(Actually, I was just looking for work-safe wallpapers in 4Chan's hi-rez, but the thought occurred.)
My Firefox has a Tools option for Start Private Browsing. I dunno what that means, but it might help foil these guys.
Posted by: https://me.yahoo.com/a/SaqGVG0xvJEQVwURVamS3DTCdvov0BLhXK1jOsYPPJQ-#b4893
|
December 3, 2010 1:45 AM
I fuckin' hate to go to the AiG website. I'd rather use steel wool on my eyeballs.
Problem solved.
MikeM
Posted by: Menyambal: Making sambal (it isn't dragon magic).
|
December 3, 2010 1:48 AM
Okay, I clicked Private Browsing in Firefox and it says:
That seems like it would work.
Posted by: https://me.yahoo.com/a/Cz9byV9pwviASQL_pos83OD7GI15XlNQ7CYf4kXm7n0-#6cdf4
|
December 3, 2010 1:59 AM
Hm. It's worrying. Sure, they're only sniffing the browser history now (from what I can tell, I'm a novice at best) but it could potentially be used to filter content in the future, or do a lot of other things.
So, in light of this...what exactly does Chrome have that Firefox doesn't?
I do find Chrome a bit difficult to use (the layout is sort of weird to me and I can never find anything, but I'll get used to it eventually) but I really can't think of any major feature differences between the two. They both have RSS capabilities, they both have customisable search bars, and as far as I know there aren't any sites that won't display properly in Chrome.
*And also in light of the continuing resource-hogging of Firefox - my PC isn't struggling with it right now, but if it keeps up I'm not sure how well 2GB of RAM will last. I do tend to over-tax my PC horribly though - I usually run World of Warcraft, iTunes, Last.fm with scrobbling, MS OneNote, Firefox with 5-6 tabs open, Ventrilo and a distributed computing program all at the same time. I've had more than one complete hang in the last couple of weeks, which tells me that my PC is on its last legs.
However, my PC is also four years old and hasn't had a single hardware upgrade since then so I'm probably bringing this on myself.
Posted by: IvanQ
|
December 3, 2010 2:12 AM
I don't know how you keep up with your email, PZ, not to mention all the comments here. I still have a smile on my face from seeing that you posted the results of my sleuthing. And I knew you'd have a laugh-out-loud take on the whole thing.
As for browser protection, I just use noscript to block javascript entirely on all but a small handful of sites, since there are plenty worse things than history hijacking that can easily be done with javascript. I also monitor all my web traffic in a console window so that I can spot junk requests and add a blocking rule to adblock. Oh, and I use the RequestPolicy addon to greatly cut down on useless cross-site traffic -- it's probably even more useful than noscript when it comes to maintaining privacy.
Posted by: Draken
|
December 3, 2010 2:56 AM
I've been on most of the sites listed and I bet many of us have. Without further correlations your browser history tells them nothing much interesting, e.g. whether you're with, or against them.
But now you understand why AiG never, ever links to Pharyngula directly; it would seduce their own target group to pollute their browsing history and render it even more useless.
Another phenomenon that's at least as eerie is browser fingerprinting which, in combination with history sniffing and IP logging, makes it almost-possible to follow your movements.
Most preventive measures require that you sacrifice (considerably) convenience for security. In order to resolve the situation more satisfyingly, browser manufacturers and W3C members would need to sit down and have a long, hard rethinking of browser technologies.
Posted by: Day
|
December 3, 2010 3:09 AM
I got a feeling the coder isn't the biggest fan of AiG.
Posted by: Rorschach
|
December 3, 2010 3:50 AM
These scripts shouldn't work in FF 4, and in older versions with private browsing enabled, or cache set to 0 and history disabled, as far as I can see.
And that's not even talking about operating systems...;)
Posted by: carole
|
December 3, 2010 4:11 AM
Posted by: IvanQ
PZ has many tentacles.
Posted by: darius
|
December 3, 2010 4:13 AM
Menyambal # 40:
Private browsing should only make a difference if you clear your history, then use it for ALL websites. It only affects what gets stored (history, cookies, etc.) not what is already there.
Posted by: Tom
|
December 3, 2010 4:20 AM
Not 100% sure but just change your preferences (in whatever browser) so that your visited link colour is the same as link colour or rather to anything other than #8281cf
Posted by: TC48
|
December 3, 2010 4:21 AM
In Firefox, type about:config in your address bar and add a new 'Boolean' called extensions.checkCompatibility.3.6 (or 3.0, 3.5, whatever version you're using). It should allow you to use almost any extension (at your own risk).
More info.
Posted by: Menyambal: Making sambal (it isn't dragon magic).
|
December 3, 2010 4:22 AM
Thanks, Darius.
I will just stick with clearing history, then, which I do often, anyhow.
Posted by: lars.melander
|
December 3, 2010 4:24 AM
I use Opera. Problem solved.
Posted by: Buttered Potato
|
December 3, 2010 4:26 AM
I think AiG is getting paranoid. Every sender of email included in PZ's "I get email" had to visit this website at least once, after all. Not to mention, what of all the creationists coming here merely to do reconnaissance and therefore not actually supporting this site? Are they snubbed by AiG? Someone correct me if wrong, of course.
Posted by: John Morales
|
December 3, 2010 4:30 AM
Buttered Potato,
Care to try to sustain this claim?
Posted by: «bønez_brigade»
|
December 3, 2010 4:51 AM
C'mon, PZ. Ken Ham just needs that for alerting his other imaginary friend about the naughty visitors. He'll be done with the script on Dec. 26.
Posted by: Buttered Potato
|
December 3, 2010 5:26 AM
@ John Morales, #53:
In meant insofar as they're responding to a claim he made, so it follows they went here to read it before writing to him.
Well, now that I think of it, many just spam him without ever coming here, if they already have his email address. Eh. It's early in the morn' and I'm not too coherent.
Posted by: F
|
December 3, 2010 5:37 AM
You can turn of version checking in about:config as well. I do, because I run all sorts of extensions that are not "compatible" with my browser version. Without exception, they've all worked perfectly well, and caused no side effects.
Search "compatibility", and toggle any found entry to false. If need be, create an additional preference following the same pattern, adding a dot, then the browser version number, to the preference name. (You do this if the extension still won't install or stay enabled.)
Of course, if you simply do not allow script to run from that site...
Posted by: John Morales
|
December 3, 2010 5:48 AM
Buttered Potato, thank you.
Posted by: davem
|
December 3, 2010 6:20 AM
You don't need any fancy add-ons to defeat this - just change the colour of your 'visited' links (edit/preferences/content' in Firefox). This will work in all browsers that allow you to change the colours.
If you want to play with AiG, make the non-visited colour the same as the visited one, so that they think that you're a web 2.0 using Christian media junkie atheist groupie...
Posted by: Duckbilled Platypus
|
December 3, 2010 6:24 AM
So do I. They still worked for them, though. Maybe they were thinking that it would be justified to part these fundies from a considerable load of money for their work. At least, I hope they charged excessively.Got to find me a few websites to fill my history with before I visit them next time. Does anyone know of any atheist gay porn sites, just to super tick them off?
Posted by: locka99
|
December 3, 2010 6:36 AM
@Andyo, I know this sounds counter intuitive but the reason Firefox uses so much ram is because you have so much ram. When you think about it, why would you want an app which you use so frequently as a browser NOT to use free memory you have sitting in your PC? I realise that FF does have memory leaks so I'm talking of its designed behaviour (to use the space you have) rather than its bugs.
Posted by: Phil
|
December 3, 2010 6:53 AM
One suggestion for all the Firefox users: NoScript. That should solve it.
Posted by: Naked Bunny with a Whip
|
December 3, 2010 6:56 AM
This is very disturbing. I'd hate for YouPorn to know I've viewed the AiG site. They may start serving up ham-based videos.
Posted by: Naked Bunny with a Whip
|
December 3, 2010 7:14 AM
I use Opera, too, but I don't see how that matters. This isn't a browser-specific exploit, it's based on Javascript's typically wide-open access to the document object model.
Posted by: David Marjanović
|
December 3, 2010 7:25 AM
Like Firefox, IE8 has a Private Browsing mode. Sooner or later Internet Explorer copies all good ideas.
Posted by: Kevin Anthoney
|
December 3, 2010 7:25 AM
#47
Really? Then why does Amazon forget who I am if I visit it under private browsing?
Posted by: davem
|
December 3, 2010 7:29 AM
Playtpus@59:
That won't work, The list is fixed - only the sites listed at the top of the page are processed. If you go anywhere else, the code above won't know. Time to stop panicking. The original code came from porn sites wanting to know whether users were also going to their rivals. One thing you can say about porn sites - they have always been users of cutting edge technology.
Posted by: David Marjanović
|
December 3, 2010 7:29 AM
Blockquoet fail. I don't think I've made that particular typo ever before.
There are just too many ways to misspell "blockquote"!
Anyway, I think whoever wrote that code is a liberal Christian who secretly despises the cretinists.
Posted by: https://me.yahoo.com/a/a1PF4kYPmsGKjsfxyV5et9iS7LLVkShV#c8522
|
December 3, 2010 7:37 AM
Just use Yes Script and blacklist AiG. No JavaScript, no JavaScript-powered history scanning.
Posted by: Erulóra (formerly KOPD)
|
December 3, 2010 7:40 AM
The developer may not have had much choice. If my boss lands a contract with AiG. My options are to do the work or find new employment.
Posted by: Carlie of the lacy, gently wafting adjectives
|
December 3, 2010 7:58 AM
I use private browsing with firefox and link colors never change.
Posted by: semopcoes
|
December 3, 2010 8:14 AM
"Thou shalt not steal?"
Posted by: semopcoes
|
December 3, 2010 8:17 AM
"Thou shalt not covet anything that belongs to your neighbor?"
Posted by:
|
December 3, 2010 8:34 AM
Oh come on, we all know there's only one commandment:
"Thou shalt ever be a hypocritical piece of sewer-dwelling scumeth, and go out and denyeth the rights of whosoever shall dare challenge or disagreeth with thou."
On a whole different note, I see lots of NoScript fans here. I've tried NoScript and RequestPolicy, and they both suck. They may give you an increased sense of privacy, but they also suck up hours of your time. You spend more damned time allowing this and configuring that than you do actually enjoying material on the web. I don't understand this approach at all. I recently had a really bad incident with NoScript whereby it was breaking a web page even when it was disabled, because of how it changed script-related settings in prefs.js. Before realizing what was wrong, I went off like an asshole, claiming the web site had bugs.
Posted by: ragarth
|
December 3, 2010 9:00 AM
I seriously doubt they're filtering content based on this code. Not only would this be a terrible means of figuring out the preferences of users, but the server-side code to enact such filtering would be a royal pain.
More likely I expect this is just attempting to get some amount of demographics as to who is visiting the site, so they know what kind of users are visiting where at a given time.
Posted by: toadslick
|
December 3, 2010 9:03 AM
Clever code, but horribly written. The title and URL for each link should be moved to a hash, eliminating the need to retype the
code over and over.Posted by: Epinephrine
|
December 3, 2010 9:15 AM
Neat; I actually hit all the categories I should, and none that I shouldn't. I miss out on "Christian", ID, and Creationist, but have at least one of the sites in every other category.
I try never to give hits to any creationist site. I have used the google cache to peek at them, I assume this avoids them getting hits. (I figure it probably works, though I'm not that computer savvy - am I corrrect? Of course, google may count cached hits in their site rankings, I have no idea.)
Posted by: stvs
|
December 3, 2010 10:17 AM
Unfortunately, the all the privacy tools mentioned here are aimed at a single exploit. Google Panopticlick, whattheinternetknowsaboutyou, and supercookies to see what information you're leaking and all the various exploits for it. Once the single hole mentioned above is plugged, there's a sieve of others. See the WSJ series on using browsers for snooping, e.g. Microsoft Quashed Effort to Boost Online Privacy . Let's just say not to trust any MS products to protect any of your personal information. But it's not just MS, all major players are in a race for the bottom of personal privacy to capture the most targeted advertising revenue.
The counters range from simple NoScript and CSS control via layout.css.visited_links_enabled as mentioned above, but more importantly and effectively TACO, BetterPrivacy, and Adobe Flash Settings to control and delete Flash "supercookies" (which are used to follow you around whether or not you delete your ordinary cookies, history, and cache), and disabling "Third Party Cookies".
Even better to use a local Squid->Privoxy proxy chain for everything, configured for privacy:
Posted by: Dude... Real Men Watch Ponies!
|
December 3, 2010 10:30 AM
4chan /b/ is not bad enough?Posted by: toth
|
December 3, 2010 10:43 AM
Wow, what a hack. Checking based on link color? The programmer in me shudders.
Also, I admit I don't know the intricacies of HTML rendering in the various engines, but I would have assumed that CSS would not be applied (at least things like color) if something is rendered with display: none. Live and learn, I guess.
Posted by: Dude... Real Men Watch Ponies!
|
December 3, 2010 10:45 AM
As far as I know, visiting a site will not increase their ranking, what's important is what other sites link to it and how "authoritative" those sites are.Posted by: newbery.myopenid.com
|
December 3, 2010 10:58 AM
Not sure if this has been pointed out yet but the code just records the data and pushes it to google analytics... no filtering going on. The very last line calling pageTracker is a standard google analytics call.
Not that this mitigates the privacy issue.
I tried to see the code in context to confirm this but the aig homepage doesn't have it. Either they dropped this really quick or the code is on another page. Shrug.
Posted by: Dude... Real Men Watch Ponies!
|
December 3, 2010 11:24 AM
Mm.
This blog post just received an auspicious recognition on Fark.com.
Posted by: Tim Buchanan
|
December 3, 2010 11:25 AM
What great timing! This from Science Daily:
Your Web surfing history is accessible
Posted by: toth
|
December 3, 2010 11:55 AM
It should also be mentioned that, while this is an extremely sleazy tactic, it's a bit of an overreaction to say that sites are "viewing your history". They're determining whether you've visited specific URLs in a hardcoded list. Sleazy, but you don't have to worry (at least with this hack) that, say, Facebook will sniff your history and find out that you were looking at a Fleshlight on Amazon (unless they specifically check for that).
Posted by: eric.kinateder
|
December 3, 2010 12:02 PM
A shorter way to do it (if you're already using jQuery) would be:
$("#statExternalLinks a:visited").each(function() {
var curSite = $(this).text();
if (userVars.length > 0) userVars += "|";
userVars += curSite;
});
It has interesting implications for tracking what sites your visitors have also been to. You could conditionally use the information to create targeted advertising or content.
For this specific script, they're just sending the information to the Google Site Analytics tracking page for their site:
pagetracker.setvar()
Posted by: Nakarti
|
December 3, 2010 1:34 PM
Browser war comment:
If your Firefox is using more than 100-200MB RAM then one of its addons has a leak. I have FF at home and at work with some custom company addons, the one at work regularly goes awol eating up as much as 3GB RAM(I have 2) bringing my system to a crawl before I kill it.
Posted by: DaveH
|
December 3, 2010 2:27 PM
Just a comment on the whole "working for the enemy" thing:
If I owned a webpage design company, I would gladly take contracts from groups like AiG. And assign them to a special coding team who all entered events like the Underhanded C Contest on a regular basis.
Posted by: IvanQ
|
December 3, 2010 3:33 PM
Looks like AiG has taken down the script, no doubt because of the shame of having actually posted a link to Pharyngula.
If anyone's curious, it used to be included in the google analytics section at the very bottom, like so:
<script type="text/javascript" src="/assets/scripts/jquery/customAnalytics.js"></script>
In fact, you can still see this bit of code on their page-not-found page, although the customAnalytics.js file has been moved or removed.
@carole
Ah... so he gets everything translated to Braille for easy tentacle-scanning... Brilliant!
Posted by: cairne.morane
|
December 3, 2010 3:49 PM
Meh. I saw this 'hack' posted on one of the tech blogs I visit and frankly it's a non-event. I reacted the same way I presume PZ did to the arsenic life story.
If you don't have a plugin like SafeHistory installed and you're not using private browsing then you should basically assume that any site you visit can know where you've been since the last time you cleared your history and cookies.
As others have pointed out the list is not really categorized - those are just comments. The code above makes no real attempt to distinguish between www.amazon.com and www.richarddawkins.net.
Secondly this trick only works for the base site address exactly as typed above. The code above for example couldn't tell if you had visited www.amazon.com?product=12inchdildos. The sheer possible number of links, even on a medium sized site, would make any detailed research using this approach impractical.
Finally I'll point that changing the color of clicked and un-clicked links will likely not work since the CSS setting would override your local browser setting.
Mike.
Posted by: daniel.lavine83
|
December 3, 2010 5:05 PM
For those saying no categorization is going on, that's true in a strict sense, but a list of these sites visited by any given user is sent back to the AiG google analytics page -- so people are being categorized according to which sites (this script infers that) they've visited. The stuff in the comments isn't functional, but it is pretty funny.
It's a somewhat clever but inelegant and unremarkable hack. I'm guessing that this is a list of sites on which AiG is considering advertising and the script is just to get some statistics to indicate how the AiG internet ad budget should get spread around. AiG does do a lot of advertising -- they had a "No God? Big problem!" ad campaign on the Boston subway, and I can't imagine a less receptive audience.
It's not even terribly underhanded compared to what web analytics companies do every day on other people's sites, let alone their own. Fine for LOLz (especially the coder's comments) but not really a very big deal.
Posted by: SlantedScience
|
December 3, 2010 6:39 PM
Creation Museum and Joel Osteen in "Other"!
Awesome!!!!!!!
Posted by: bombria
|
December 3, 2010 8:27 PM
The latest versions of Firefox, Chrome, and Safari now block the history sniffing attacks the computer scientists monitored. Internet Explorer, however, does not currently defend against history sniffing. In addition, anyone using anything but the latest versions of the patched browsers is also vulnerable.
http://www.physorg.com/news/2010-12-web-surfing-history-accessible-javascript.html
Posted by: A Bad Idea (♀)
|
December 4, 2010 6:49 PM
I consider checking anything other than the referrer to be unacceptably rude towards users... but I do find it strange/amusing that they're checking for the movie trailers page at Apple... and that the coder was apparently shanghaied into this.
Thankfully, they are almost certainly only doing demographics with this, rather than content filtering.
Posted by: chenxin
|
December 7, 2010 6:03 AM
NFL Jerseys Cheap NFL Jerseys Wholesale NFL Jerseys Cheap Jerseys Wholesale Jerseys NFL Women’s Jerseys NFL Hats NFL Youth Jerseys Reebok NFL Replica NFL
http://www.jersey4nfl.com
Posted by: chenxin
|
December 7, 2010 6:07 AM
NFL Jerseys Cheap NFL Jerseys Wholesale NFL Jerseys NHL Jerseys Cheap NHL Jerseys Cheap Jerseys Wholesale Jerseys Wholesale NHL Jerseys MLB Jerseys Cheap MLB Jerseys Wholesale MLB Jerseys http://www.nfl2shop.com
Posted by: SQB (fuck death)
|
December 12, 2010 3:05 AM
What the Internet knows about you has a larger list of sites they're checking against.
Posted by: Rorschach
|
December 12, 2010 3:15 AM
That'll do for now.