Privacy or security issue in styling visited link colors

User Help for Mozilla Firefox
Post Reply
phkhgh
Posts: 845
Joined: January 25th, 2007, 2:49 pm
Location: So. U.S.A.

Privacy or security issue in styling visited link colors

Post by phkhgh »

Years ago, Mozilla disabled the ability to change visited link colors because at that time, sites could see the sites visited in Fx.
That got fixed. Recently, I noticed visited links weren't changing color on many sites & much more so, if they were links on the same domain.

I looked around & the old "a:visited {color: #C506FC } still didn't make most sites change.
I started wondering if another issue came up where Mozilla thinks it's not a good idea.

After a LOT of looking came across https://developer.mozilla.org/en-US/doc ... S/:visited
I don't know when this article was last updated, but some of the links on the above page to others about "privacy & the :visited selector" are 20 yrs old. So dunno what to think.

Per the main article, I found visited links did change colors, WHEN you 1st used something like

Code: Select all

a {
  /* Specify non-transparent defaults to certain properties,
     allowing them to be styled with the :visited state */
  background-color: white;
  border: 1px solid white;
}

:visited {
    color: #c506fc !important;
}
Specifying the background-color as white, even on a site w/ dark background, made changing visited link color work, but didn't visibly change the bg color of links, even on dark BG pages.
It also made visited links change, whether on the same domain or external sites.
Note: for a long time, I didn't have to set the background color for links, for visited links to change color, pretty much everywhere. Most of the time was using Linux.

Code: Select all

a { background-color...
So, is there any current known security / privacy issue in changing JUST the visited link (text) color, in Fx 80 - 87. Or in setting the BG color as demonstrated?
The article mentions only certain properties in the :visited pseudo class can be modified, and how. But again, some info the article links to is 20+ yrs old.
User avatar
dickvl
Posts: 54164
Joined: July 18th, 2005, 3:25 am

Re: Privacy or security issue in styling visited link colors

Post by dickvl »

Code like a:visited {color: #C506FC } without the !important; flag (i.e. not a:visited {color: #C506FC !important;}) only works if the website doesn't specify its own text color.
Note that overriding the background color with the !important flag will lead to issues when the link is a background image and this image will be hidden completely leaving only the specified background color.
phkhgh
Posts: 845
Joined: January 25th, 2007, 2:49 pm
Location: So. U.S.A.

Re: Privacy or security issue in styling visited link colors

Post by phkhgh »

Thanks.
EDIT 2021-04-05. I guess no one (yet) fully understands how before the change in Fx 87, "The <link> element is no longer matched by :link, :visited, or :any-link," was exploited, making it a privacy issue? Mozilla listed the change under the Developer section & didn't mention (to users) in Fx 87 Release Notes, that it fixed a privacy issue.

The wording in https://developer.mozilla.org/en-US/doc ... S/:visited, in Browser Compatibility chart, that ":visited privacy: selector does not match <link> elements" wasn't changed till Fx 87 is a giveaway that it was a privacy issue. An issue changed in Chrome v1 & Opera v15.
END EDIT.

Somewhat related issue:
Fx 87 changes (developer) "The <link> element is no longer matched by :link, :visited, or :any-link."
They are calling this a privacy issue. And Fx was way late to change this vs. most browsers.

But I've found very little to explain how before Fx 87, this could be exploited - making it a privacy issue.
Before the change, how could sites exploit the <link" element MATCHING the :link, :visited, or :any-link," making a potential privacy issue?

Like, how sites could gather (what) info, regarding <link> elements matching :visited, :link, or :any-link,

The chart & Fx 87 changes Imply that before Fx 87, the :visited selector COULD match <link> elements, but I don't understand how it was used.
Post Reply