Interactive History Sniffing Attack with Amida Lottery

摘要

Browser history sniffing is one of the exploits in browser security. Weinberg et al. proposed an interactive attack that provides a simple Captcha test to victim users who performs actions that reveal if he/she has visited to particular website or not. The study proposes six examples such as chessboard and word spelling. Their scheme, however, probes one site with one click and hence it is hard to retrieve a large number of websites. In this study, we propose a new Captcha test using a lottery called "Amida" that allows to probe arbitrary number of websites with one click. We examine the performance of proposed scheme and shows the comparison between our scheme and the conventional "chessboard puzzle".