YouPorn sued for sniffing browser history

Of course the fact that they have been sued does not mean they did anything illegal (or even anything wrong). It just means that a couple of people in California scraped the money together to instruct a lawyer.

I think it's just market research for them. That doesn't mean that it's not a privacy issue.

On the other hand, I agree that there are worse things to worry about.

At the risk of sounding like a corporate apologist since I write for Wired.com, Wired.com did NOT use the javascript history hack. It was noted in the report for using Tynt.com, which notices which portions of a story a reader copies and pastes and inserts a link back to the story. Wired.com has since stopped using the service, in no small part because it annoyed the writers, but it never, to my knowledge and to the report's findings, secretly captured users' browser histories. You can read the full report's findings at the following link: http://cseweb.ucsd.edu/users/lerner/papers/ccs10-jsc.pdf.

That is not necessarily sufficient, because there are many, many variations on this attack.

For example, suppose my target site has an asset at a well known URL, such as:

http://www.google.com/intl/en_ALL/images/srpr/logo1w.png

I could execute Javascript on your machine to load that in a standard IMG tag, in a div with display: none set on it. I could then, via a variety of fairly unobtrusive methods, time how long it takes your browser to load that image.

If you have been to Google recently, that image will be cached, and your browser will load it almost instantaneously. If you have not been to Google recently, that image will not be in your cache, and my Javascript will trivially be able to tell the difference between "presence of a network request going through the Internet" and "absence of said request."

You don't even really need the asset if you want to be tricky about it. (I can time your DNS cache, too, it just takes a little more work.)

"Not compatible with 3.6.12". :(

Looks like someone implemented this for Chromium as well: http://codereview.chromium.org/1591027/show

I'm not sure if it is main Chrome builds yet or not. Anyone know the status of this?

I'm guessing they can see what fraction of their visitors also visiting their competitor's site.

I'm not sure what else they can gather but I'd imagine that if you can pick up on what "videos/pages/articles" those visitors are visiting, you can seed your own site with similar content to further entice them to use your site as a primary resource and decrease the chance they will visit the competition.