YouPorn, Perez Hilton Exploit Bug to Obtain Your Browsing History
Researchers at the University of California San Diego have discovered a bug that many sites are using to track the browsing behavior of their visitors. The flaw was found on some 485 websites, including YouPorn …
Context & Ripple Effects
History sniffing is not new to the security press: The Register flagged the same class of web bug on the world's most popular sites back in September 2008, and in April 2010 the BBC covered malware that outright published victims' browsing histories. What changes with the UC San Diego work is scale and naming: the researchers put hard numbers on the practice, finding the flaw exploited on roughly 485 sites.
The confirmed list mixes mainstream celebrity media with adult entertainment — Perez Hilton's site alongside YouPorn — which matters because both categories monetize intimate interest data, giving them an unusual incentive to probe what else a visitor has viewed. With no syndicated pickups recorded at publication, the disclosure's reach so far rests on the research itself rather than broad press amplification.
First-order effects
- Visitors to YouPorn, Perez Hilton and the other affected sites had their cross-site browsing histories readable by those pages without any indication to the user — the immediate harm falls on anyone who browsed while logged into nothing and opted out of nothing.
- YouPorn and Perez Hilton now carry a documented privacy-practice finding from academic researchers attached to their brand names, a reputational exposure neither chose to court publicly.
Second-order effects
- Advertisers buying against these audiences face a provenance problem: audience data gathered via history probing is exactly the kind that regulators and ad networks may refuse once its collection method is public.
- Other site operators among the 485 face pressure to strip the probing code quietly before being named, effectively forcing a cleanup pass across a long tail of sites that assumed the technique was invisible.
Third-order effects
- If browser makers treat visited-link styling and timing probes as attack surface rather than features, covert client-side side channels get closed one by one — pushing behavioral tracking toward techniques that require third-party script placement instead.
- Adult and gossip publishers, whose business models already trade on sensitive interest data, become the recurring test cases for how far passive visitor surveillance can go before it triggers platform-level or regulatory response.
The trend: Web tracking is migrating from disclosed mechanisms like cookies toward covert exploitation of browser side channels, with academic disclosures forcing each technique into the open faster than operators can adopt it.