Very interesting!

However, whilst your test case worked the first time I visited the page (it told me I'd visited Digg.com and Blog.outer-court.com) I then clicked the CertainlyUnvisitedBlabla1921920230.com and HelloWorld.com links and it's now telling me that I've visited Www.digg.com and Blabla1.com – i.e. the opposite to what I've visited. (I think this is more a problem with your implementation than with the concept though...)

i know very little javascript, but couldn't the same thing be accomplished with the Javascript History object? Does history() return a URL, or just send a command to the browser to go back a certain number of page views?
if it returned a URL, then you could do a loop to find the last 1000 page views or whatever and send that back

I tried the test page script.. I never visted digg at all today .. so why did that pop up ?

You visited Digg yesterday or last week.

The history object does not return anything usefull.

I may sound stupid but can't modern web statistics like Google Analytics or Crazy Egg tell which links you clicked anyway?

2 Tadeusz Szewczyk,
Yes, they can. But only for links in your web site. But what if you want to find out whether your readers are visiting web sites of your competitors? Or, for example, Dell wnats to know whether you go to HP website or not. They just create a hiddenlayer, put a link to HP in there and then check it with javascript :)

Oh man, that's brilliant! Ignoring the implications, you could really mine some useful data for analytics with this. Very neat!

It's quite basic, I think. You have to test against a list of predefined url's. Then everybody can read the javascript too.... And if you install the trace me not firefox extensions, results become useless...

Putting aside my initial skepticism.. I think this is a brillent idea..

Using CSS in this way is a well known technique.

See http://gemal.dk/browserspy/css.html on the BrowserSpy site that offers a huge range of tests to find out about the browser that is used to visit the pages.

Unfortunately that page is dumb. It says "no visit" for each and every site, although I visited some of them. The only way I could make it say "visited" is by clicking on a link and then going back.

Browsers only keep visited information for a (configurable) number of days, so I would fully expect that sites you have visited a while ago will say "no or unable to detect".

Those you have visited within the time the browser keeps the information for say "Yes you have been visiting the site lately!"

No. I opened a new tab with icq.com, and that page still said I didn't visit icq.com after a refresh.

I saw this about four years ago, why now this is a news everywhere? :]

Art-One:

Got a link to Trace Me Not? I didn't find anything through search engines.

Thanks for the mention.

To clarify (and given people don't bother to read boring "words" that explain "how things work," ie., as noted on my test page and external links – or perhaps due to my boring style of writing,) I'll explain. ;)

This technique only works on explicit URLs which have been directly visited and are in the browser history, and picked up by CSS' :visited pseudoclass. In other words, it doesn't "find where you've been" – it only looks to see "if you've been to a specific URL."

eg. there could be at least two variants (http://blog.. and http://www.blog.) pointing to this post which could be "tested" for :visited. I only looked at the top level of a few sites, eg. http://digg.com/ and http://www.digg.com/ – so if you had visited digg.com/some_article/ and not the root of /, the domain root would not register as being "visited."

I wanted to poke some light fun at the "Web 2.0" meme, so I used Javascript in an interactive example – but javascript isn't a requirement for the trick to work.

Browsers could theoretically start preventing :visited from being applied to external links on a site, OR prevent Javascript from accessing the style property of external links (determining :visited dynamically.)

Either way, it's a rather moot point as clicks on external links can always be tracked when clicked; theoretically a dictionary-style attack could be carried out, but would be pretty impractical.

As noted, this technique is at least six years old; the dynamic JS method is just a bit more consistent now with modern browsers having more consistent support for reading style attributes and so on.

Matt: sorry it's correct name is Track Me Not...
Here it is ... http://mrl.nyu.edu/~dhowe/TrackMeNot/

works in Opera too!

Yes Tony, as soon as you visit CertainlyUnvisitedBlabla1921920230 the script breaks. I should hide this URL, it was meant to be one you will never visit :)