Yan Zhu, a security researcher, writes about browser privacy, fingerprinting, history sniffing, and web security attacks.
HN links it for browser history leaks such as the Sniffly HSTS timing attack and for her response to a Cypherpunks 2.0 talk.
Sorry to TL;DR but 50 page PDFs can be opaque for discussion.
The presentation takes a while to get around to it, but it's a way to see your browser history using cert pinning/redirection. Specifically (ab)using features in the browser that even the paranoid don't disable. And then using that information to fingerprint you.
Demo: http://zyan.scripts.mit.edu/sniffly
Code: https://github.com/diracdeltas/sniffly
It's a good find, even if it's not perfect the way the CSS link visited computed style checks was.
I went to this talk last night and wrote a blog post in response to it: http://zyan.scripts.mit.edu/blog/thoughts-on-cypherpunks-2-0/
The gist of it is that although the Cypherpunks 2.0 movement is doing fantastic pro-privacy work, it will eventually be constrained by the apathy of the average person who uses technology (aka, surveillance victim). I don't know how we can fight this, but we should try.
Read the linked article: https://zyan.scripts.mit.edu/blog/backdooring-js/
It has the answer to your question. Namely, you can write bugs that are exploitable that aren't present in the original source, that only appear in the minified output. Which means that a) it is a whole lot harder for someone to find (especially if it's something that is "obviously" correct), and b) it's plausibly deniable.
In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built demos for!
In case anyone's interested, slides are up at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf and talk recording at https://www.youtube.com/watch?v=kk2GkZv6Wjs
All of the interesting content is in the link provided in the list[1], and otherwise this is just a post about how debian should handle the security issues presented there.
This might be a good candidate for having the link updated.
[1]: https://zyan.scripts.mit.edu/blog/backdooring-js/
No, you want the minified source to do something different but predictable so that nobody reading the source could spot the backdoor without knowledge of the bug. Here's an example:
https://zyan.scripts.mit.edu/blog/backdooring-js/