Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I am on two sites with a browser, can one of those sites see what I am doing on the other site?

share|improve this question

migrated from stackoverflow.com Mar 2 '11 at 10:54

This question came from our site for professional and enthusiast programmers.

add comment

3 Answers

Yes, if both sites have the same domain and javascript code to do that. No otherwise, unless there's a serious security flaw in your browser or system that is being exploited.

Reference: http://tools.ietf.org/html/draft-abarth-principles-of-origin-00

share|improve this answer
2  
…for completeness sake, assume that 'security flaw' also includes user-installed viruses, worms, and trojans. ;) –  kojiro Mar 2 '11 at 4:45
    
Not to promote any browser here but Chrome is really good at handling this type of security flaws and was designed from the bottom up with that in mind... (and I don't know about the other browsers but AFAIK IE9 has the worst mechanism for handling this situations). –  PedroC88 Mar 2 '11 at 4:53
5  
@PedroC88 Many user agents, certainly all A-list browsers implement the same-origin policy. Do you have some documentation that you're basing your comment on, or are you just a big fan of Chrome? –  kojiro Mar 2 '11 at 4:57
    
I don't, I speak mostly from a user-experience perspective. –  PedroC88 Mar 2 '11 at 5:04
2  
@Pedroc88 Can you provide examples from that experience showing that IE9 is worse than chrome in this respect? –  Joe Taylor Mar 2 '11 at 10:57
show 1 more comment

If all is well, then currently: no, not in the way you describe (simultaneous browser sessions).

But, more general given the title of your question, bugs and privacy leaks might always be exploited. Like today in some browsers, embedding links to the other sites might reveal if you visited those, by abusing an old "visited links" privacy leak. December 2010:

The 46 sites exploit a widely known vulnerability that currently exists in all production version browsers except of Apple's Safari, which earlier this year became the first major browser to insulate users against the threat. Google Chrome, which is based on the same Webkit engine, soon followed. Beta versions of Mozilla Firefox and Microsoft Internet Explorer also fix the problem, but production versions of those browsers are still wide open.

The exploit works by using JavaScript to read cascading style sheet technologies included in virtually every browser that causes visited links to appear in purple rather than blue. Developers have known of the weakness for a decade or more but until recently said it couldn't be easily repaired without removing core functionality.

share|improve this answer
add comment

Depends. If they share tracking code and set everything up to track behavior on both - then yes. Also there are many ways for malware to do so.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.