Web browser history detection as a real-world privacy threat

Abstract. Web browser history detection using CSS visited styles has long been dismissed as an issue of marginal impact. However, due to recent changes in Web usage patterns, coupled with browser perfor-mance improvements, the long-standing issue has now become a sig-nificant threat to the privacy of Internet users. In this paper we analyze the impact of CSS-based history detection and demonstrate the feasibility of conducting practical attacks with min-imal resources. We analyze Web browser behavior and detectability of content loaded via standard protocols and with various HTTP response codes. We develop an algorithm for efficient examination of large link sets and evaluate its performance in modern browsers. Compared to ex-isting methods our approach is up to 6 times faster, and is able to detect up to 30,000 visited links per second. We present a novel Web application capable of effectively detecting clients ’ browsing histories and discuss real-world results obtained from 271,576 Internet users. Our results indicate that at least 76 % of Internet users are vulnerable to history detection, including over 94 % of Google Chrome users; for a test of most popular Internet websites we were able to detect, on average, 62.6 (median 22) visited locations per client. We also demonstrate the potential to profile users based on social news stories they visited, and to detect private data such as zipcodes or search queries typed into online forms.