Most surfers vulnerable to "history sniffing" attacks