"Nobody knew if anyone on the Internet was using history sniffing to get at users` private browsing history. What we were able to show is that the answer is yes," said Hovav Shacham.
History sniffing takes place without your knowledge or permission and relies on the fact that browsers display links to sites you`ve visited differently than ones you haven`t: by default, visited links are purple, unvisited links blue.
Out of 485 sites, 63 transferred the browser`s history to the network. "We confirmed that 46 of them are actually doing history sniffing, one of these sites being in the Alexa global top 100," the UC San Diego computer scientists wrote. "I think people who have updated or switched browsers should now worry about things other than history sniffing, like keeping their Flash plug-in up to date so they don`t get exploited.
But that doesn`t mean that the companies that have engaged in history sniffing for the currently 60 percent of the user population that is vulnerable to it should get a free pass," said Shacham.
"We detected when browser history is looked at, collected on the browser and sent on the network from the browser to their servers. What servers then do with that information is speculation," he said.
The computer scientists from the UC San Diego Jacobs School of Engineering presented this work in October at the 2010 ACM Conference on Computer and Communications Security (CCS 2010).