16

Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser?

One example of this is the tab that opens by default when you start a new Google Chrome window and contains lots of little thumbnails of previously visited websites.

We have privacy concerns around displaying sensitive information from a web app in one of these thumbnails. (Vaguely similar to how sensitive information may be leaked via the task switcher on a mobile device)

I would assume that there was a HTTP header / meta tag that would be able to do this but so far I have not discovered anything in my research.

Cache-directive headers and other standard methods of preventing a page from being cached that we have tried so far don't appear to work.

Edit: I am asking in the position of a service provider running a website that displays sensitive information and doesn't want the user's browser to show that to anyone who can see their screen when they open a new tab.

  • Incognito mode? – Tristan Jun 16 '16 at 14:02
  • 3
    I was asking from the side of the provider - e.g. if for some reason I was running an online financial website and decided to display the user's current balance in text that could be read from a thumbnail (either normally or when zoomed in). The user could just use incognito mode - will update the question to clarify :) – Stu W Jun 16 '16 at 14:07
  • Oh now I get it :) – Tristan Jun 16 '16 at 14:12
  • 6
    I'm not sure whether there is a standard way to get rid of such entries on the provider side (save for asking the user to do it), but I believe I've seen a work-around where the first rendered page of the server is empty (or only contains some layout), and the content is loaded later per JS or something similar. Alternatively you could have such data only ever appear on sub pages, as the preview typically contains the first page a user visits on that domain. – Rens van der Heijden Jun 16 '16 at 14:24
  • 3
    @RensvanderHeijden At least Firefox seems to be able to make a thumbnail of how the site looks at some point after the initial load. I know one where the drop-down menus stubbornly tend to appear on the thumbnail, and there's nothing special about that one (just HTML and some CSS). – a CVn Jun 16 '16 at 20:36
2

This is an interesting question why I was looking into the source code of Chromium too see how they do it.

The Answer

It is nearly impossible to implement a 100% reliable feature to prevent a screenshot that will be used in the most visited view. You have to hide the sensitive content right the moment the service is storing the data. Which might happen all of a sudden and without a warning (at least from the view of the website).

Technical Details

They have a service running which is responsible to evaluate the top sites. There is another service which is responsible to create screenshots of such pages. In top_sites_impl.cc there is TopSitesImpl::GetUpdateDelay which returns the interval for creating such images. The default value is 30 seconds:

if (cache_->top_sites().size() <= prepopulated_pages_.size())
   return base::TimeDelta::FromSeconds(30);

But it might get much more complex then that:

int64_t range = kMaxUpdateIntervalMinutes - kMinUpdateIntervalMinutes;
int64_t minutes = kMaxUpdateIntervalMinutes -
                last_num_urls_changed_ * range / cache_->top_sites().size();
 return base::TimeDelta::FromMinutes(minutes);

Furthermore there have to be some special events met to re-initiate this update mechanism. This is implemented to prevent spamming the top pages service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.