Visit duration tracking possible in TorBrowser using a favicon which downloads from a server using a connection that's never closed
The attack scenario is described here https://twitter.com/davywtf/status/951203191944773632.
The code sample can be found at https://github.com/wybiral/tracker.
Trac:
Username: ehsan.akhgari@gmail.com