I have heard stories about people getting users' browser history and using this data for evil. I have been asking myself for the last two weeks if this is really possible.
Today, I met the founder of AddToAny, a web sharing service similar to AddThis and ShareThis. We were talking about usability of their service and he told me that there are different levels of user oriented implementations in their service. I am not going to tell you all the methods he mentioned to me however one of the methods that they use gave me the answer that I have been looking for... It turns out the answers is "YES!" it is possible to get the list of sites from the browsing history.
After coming back home and searching for the ways to do it, I found a ticket at bugzilla.mozilla.org which was created in 2002. (Bug 147777 - :visited support allows queries into global history) Reading through comments, I found out that there does not exist a fix for this bug while obeying the specs. (read the comment thread if you like real brainstorming)
Implementations
There are several implementations on the web relying on this bug:
- Aza Raskin's SocialHistory.js, code which enables you to detect which social book marking sites your visitors use.
- Find out if your friends are watching porn!
Estimate gender of your site visitors...
Paul Stone's smart crawler
Limitations
:visited only tells if the exact URL is browsed however it doesn't give out the information for a domain name. So if your porn addict friend has never visited the homepage of the website, you will never learn if s/he has been on the site before...
Still Privacy
"Yes, I still do believe in privacy" and don't really want to share my browsing history with the third parties. However, as a UX engineer, I would use this bug whenever I can make use of it without being evil. Unless, the specs get updated, and this bug is fixed, it is out there and all yours.
PS: Install SafeCache plugin, if you want to prevent this leak.
