Wow, CSS is the new JS :D
Crooked Style Sheeding – Webpage tracking using only CSS
21–30 of 180 posts
Re: Crooked Style Sheeding – Webpage tracking using only CSS
#22Re: Crooked Style Sheeding – Webpage tracking using only CSS
#23If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…
> not an easy fix
All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.
Re: Crooked Style Sheeding – Webpage tracking using only CSS
#24Re: Crooked Style Sheeding – Webpage tracking using only CSS
#25Nice POC! I love the project name :)
Re: Crooked Style Sheeding – Webpage tracking using only CSS
#26Whose going to be first to make the 'I always browse the Web with CSS disabled' post?
Using lynx, the only thing that makes reading Hacker News somewhat inconvenient is the lack of indentation to show the nesting hierarchy, but otherwise it works quite well.
Some other sites are so messed up that it's actually more comfortable to read them in a text-only browser that completely ignores CSS and replaces images by their alt-tags.
Of course I frequently do want to look at images, so my main browser remains Firefox, but it's still useful to remember that other browsers with different tradeoffs exist and can be used.
Sometimes, you really just want to read some text and don't need any of that fancy other stuff.
Re: Crooked Style Sheeding – Webpage tracking using only CSS
#27Interesting trick. But I think adBlockers block requests to entire tracking domains. So even css calls would be blocked?
That's a good point, if you're only concerned with tracking from a specific set of domains.
Re: Crooked Style Sheeding – Webpage tracking using only CSS
#28But how many users disable JavaScript in their browser to prevent tracking? And is the fact that a website can track all your clicks and mouse movements a privacy/security issue to begin with? Isn’t it by design that the website you’re visiting can track you?
> by design
By design, the web is a "1. send me the document 2. here it is" transaction, not a series of many small notifications. By design, the url() property almost certainly wasn't intended to be dynamic. This is clearly 'bending the established rules' — cleverly, admittedly.
Re: Crooked Style Sheeding – Webpage tracking using only CSS
#29If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…
> not an easy fix All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.
While we, as devs, may get tired of the constant beat-down between site flexibility and privacy, many of our users are unaware. They will go blindly towards flexibility and we have a duty to find as much compromise as possible between those two values lest we just say "it's an easy fix, just turn off your computer". There has to be a middle ground between extremely paranoid turn everything off and extremely liberal with my anonymity (and on the internet, it's not governments who are going to help find it).
Re: Crooked Style Sheeding – Webpage tracking using only CSS
#30The obvious solution is to block the server-side pages that the CSS elements link to. This kind of tracking can be mitigated the same way any other kind of tracking is already handled by uBlock or uMatrix.