Hacker News new | ask | show | jobs
by jfk13 1577 days ago
Sure, it shows those colours to the user. But they're not exposed to the website; if it tries querying the colour of the links, the browser returns the same blue value for all of them, visited or not.
1 comments

It used to be that CSS leaked all visitor states with no user interaction. This was patched by browsers a few years back, but there are still ways to extract some data from :visited, it just requires user interaction now.

https://frantzmiccoli.github.io/visited-captcha-history/

That's pretty limited though. You can only check urls (not domains), and only as many urls as there are characters in the captcha.

It's a clever hack though!