Answers in Genesis website hijacks web history!

[Tiberius]

You asked me why that information is supposed to be private. I told you that by assuming a worst-case scenario, which involved criminal activity. Yes, we have to presuppose the intent of a phisher, because the mere existence of such a person is grounds for protecting the privacy of where you go online.

Finding out which places people visit is actually rather hard, since everything usually goes through a localised router, which adds a degree of anonymity. If I were inside the network, I could sniff packets and determine where you went, but that involves me being close to you (geographically), and that limits the number of people I can attack (and reduces the likelihood of an attack occurring). If I am outside the network, finding out where you go is almost impossible, but the fact is it should be impossible (or very very hard) so that any attack has a very low success rate. The code that determines where you have been on the web is easily installed, making it very easy for someone to find out where you have been.

Look at it this way. Why do we have seat belts in cars? The vast majority of us don't have a need for them, since the vast majority of drivers don't get into accidents. However, we have them there because of the worst-case scenario, and in that case, they save lives. Sure, we could open up our browsing history and let anyone know where we have gone on the web, because most of the time it is of no interest to anyone. However, the worst-case scenario involves a breach of privacy, which leads to a loss of money and / or personal details. For this reason, we must secure our web history.

[Jaysyn]

Go here to see if you are vulnerable.

If you are using Firefox, follow the instructions below to plug the privacy hole.

Type "about:config" with no quotes in your address bar.

Set layout.css.visited_links_enabled to false

[theVOID]

False analogy Tack, in your hypothetical the only things that are public are the things you chose to take out into the world with you.

This scenario is more like someone being invited into your house to remove your TV set and taking your receipts folder with them.

[Jaysyn]

Why is it that the information in the history of your browser supposed to be private? Wouldn't that be the same as someone following you around for a few days finding out what store you shopped at.

Stalking is illegal in my state.

[Minimalist]

Go here to see if you are vulnerable.

If you are using Firefox, follow the instructions below to plug the privacy hole.

Type "about:config" with no quotes in your address bar.

Set layout.css.visited_links_enabled to false

Once one gets to the appropriate line how does one make the change.


And remember.... I'm old so don't get too complicated!

[Jaysyn]

Go here to see if you are vulnerable.

If you are using Firefox, follow the instructions below to plug the privacy hole.

Type "about:config" with no quotes in your address bar.

Set layout.css.visited_links_enabled to false

Once one gets to the appropriate line how does one make the change.


And remember.... I'm old so don't get too complicated!

Type layout.css.visited_links_enabled into the filter textbox, then double-click on the resulting entry below.

[Minimalist]

That was simple.

[Jaysyn]

That was simple.

You can try that website again & see that they can no longer sniff your browser history. I don't know why that isn't enabled by default on Firefox, but it is in the Firefox 4 Beta.

[tackattack]

I agree that planning for the worstcase is viable and it might be a false analogy. If I had to draw a line in the sand though saying that this is malicious, I'd put it between pulling browser history and traping transmitted data. I was just making the overall point that the majority of people shouldn't have much to hide, so it's really based off of intent not legality. Was AIG, or the banks or other sites on the list intending an attack, I don't think so. Using them as fuel to propigate justifiabe fear of safe sufing is skewing the social view of them to put them in line with malicious hackers. That only benefits political agendas and not the reality of protecting yourself from threats.

[Jaysyn]

I agree that planning for the worstcase is viable and it might be a false analogy. If I had to draw a line in the sand though saying that this is malicious, I'd put it between pulling browser history and traping transmitted data. I was just making the overall point that the majority of people shouldn't have much to hide, so it's really based off of intent not legality. Was AIG, or the banks or other sites on the list intending an attack, I don't think so. Using them as fuel to propigate justifiabe fear of safe sufing is skewing the social view of them to put them in line with malicious hackers. That only benefits political agendas and not the reality of protecting yourself from threats.

As someone who knows just a little bit about computer security, I'd have to say that is a very naive point of view.