Yes... How?

Yep. How the...?

Yep

View-source on this site's main page. Notice the zero-size iframe Philipp is loading from Google.

Great! ;-) iframe :-)

Clever stuff Philip – I like it!

Sneaky Sneaky!

Yes – can you explain exactly how this worked? Can any website add items to my "search history"? This is kinda scary....

Hmm I don't have that showing up. But I guess thats because I hit this article from the feed. The iframe is located on the homepage =P.

Michael Zimmer:
Phillip is loading up an iframe with the google query preloaded.

http://www.google.com/search?q=Google+Blogoscoped+sneaked+in+through+the+backdoor

The search gets loaded up in your history due to the frame.

lol, nice =)

Of course the URL in the iFrame could be in this form :-

http://www.google.com/url?&q=http://www.spam.com/?-Buy-Cheap-Spam-Here!!!

(Try it: Google cheerfully redirects to the target site. And the stuff after the question mark needn't be in the page URL itself).

And could be embedded within iFrame ad blocks, hidden or otherwise. Dozens of iFrames per page, perhaps. Not AdSense (I don't think), but plenty of other ad networks allow iFrames.

My Search History spam is born ...

Seems like you can kiss Search History goodbye...

>> can you explain exactly how this worked?

The page has a simple <iframe src=""> tag in it with the src attribute referencing a Google search.

>> Can any website add items to my "search history"?

Oh yes. In fact they could be dozens in each page.

Well done for doing it. but totally worthless. please don't leave it on the site too long, i don't want it to appear on my history everyday

Interesting. Trying to see some advantage though. It doesn't raise your page ranking or help with Google visibility. And it only works with pages you actually visit.

So If I wanted to look at my history I could do that in my browser history. This just transfers a page from there to the Google Search History.

How could this be used to any advantage???

>> How could this be used to any advantage???

I'm more concerned about how this could be used to a disadvantage. Could a site I load surreptitiously add searches to my history that could get me into trouble if my spouse, employer or local government agent looked at my search history?

<< I’m more concerned about how this could be used to a disadvantage. >>

Me too. This is why I haven't set it up and why I can't get myself to use Google Desktop either. There seems to be too many disadvantages.

david s : The advantage is that it can put adverts (in the form of spammily-phrased URLs) on a page (users' My Search History pages), which is otherwise inaccessible, and amongst the 'content' (actual searches), which users want to scan to find something.

It's an almost ideal placement. At worst users see the text message. At best, the link is visitable (either through the redirect trick mentioned above, if that redirect URL actually triggers collection by GSH: I'm not sure. Or by the spammers site being at or near the top results for the spammy search phrase. Or if the phrase includes keywords to generate specific Ads on the Google SERPs page).

And whilst the trigger site must be one you visit, the injected links can be by dozens of third party sites who advertise (visibly or invisibly) on that one site.

Michael: Absolutely, yes. Maliciously, or as pranks. And they'll be no way of telling which site did it, once the hidden iFrame link is removed or changed.

And I don't think we've thought of all the possible ramifications yet.

Unless Philip has more to come ...

Wouldn't it be more subtle to use <link rel="prefetch">?
(Would only work on Firefox, though.)

   – Michael

The redirect trick doesn't work (MSH doesn't recognise google.com/url?&q= as a search page).

But multiple links sure do. Here's a simple test page :-

http://www.imilly.com/my-search-history-spam-testpage.htm

It could all get much worse than that, though.

It can also be done with web bugs (clear gifs), of course :-

http://www.imilly.com/my-search-history-spam-testpage2.htm

And probably a few more methods too.

It didn't appear in my Google search history.

It's not in mine, either.

IE asked me first, and I said no, so it didn't appear.

is there some way to make firefox ask me first?

Rob NJ and Linda W: What didn't appear – Philip's original "sneaked in through the backdoor" link, or the ten on my test page(s)? What steps did you take?

chris o: How and when and exactly what did IE ask?

Wouldn't anyone who started to spam people's search history be easily identifiable by Google and could be punished by being removed/have their PageRank lowered in their index?

Google could add some javascript to determine if the search is from a tiny tiny window/iframe, then just look at whatever shows up at the top of search results, cross-reference that with the referering website, and you know your spammer. Way easier to identify than a link farm, I would think.

I think ultimately this would hurt someone more than help. If enough of the "searches" are performed and no results are clicked then Google may drive down relevance for those sites that appear in n the top 10. Maybe OK to do for a competitor but not for a site where you rank.