Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crooked Style Sheeding – Webpage tracking using only CSS

github.com

Post reply on HN
Print view View original

41–50 of 180 posts

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#41

Post by vog »

keypress wrote: post #37
oneeyedpigeon wrote: post #23

Earlier quoted context omitted.

> not an easy fix All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.

Happily used to (5 years ago) surf the web with no JS and no CSS, or rather applying my own style-sheet for 90% of my web viewing. I'd fall back to Chrome when absolutely necessary. It was fast and comfortable, it just relies on well structured accessible content.

There's also a nice Open Source project which implements that using a proxy:

https://www.tedunangst.com/flak/post/miniwebproxy

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#42

Post by dahart »

keypress wrote: post #37
oneeyedpigeon wrote: post #23

Earlier quoted context omitted.

> not an easy fix All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.

Happily used to (5 years ago) surf the web with no JS and no CSS, or rather applying my own style-sheet for 90% of my web viewing. I'd fall back to Chrome when absolutely necessary. It was fast and comfortable, it just relies on well structured accessible content.

> it just relies on well structured accessible content.

Honest question: how much of this is left? What popular sites are still accessible this way? HN might be the only site I visit frequently where browsing with no js/css has any hope of working.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#44

Post by rplnt »

dahart wrote: post #42
keypress wrote: post #37

Earlier quoted context omitted.

Happily used to (5 years ago) surf the web with no JS and no CSS, or rather applying my own style-sheet for 90% of my web viewing. I'd fall back to Chrome when absolutely necessary. It was fast and comfortable, it just relies on well structured accessible content.

> it just relies on well structured accessible content. Honest question: how much of this is left? What popular sites are still accessible this way? HN might be the only site I visit frequently where browsing with no js/css has any hope of working.

No js is suprisingly fine. Google search works, gmail works, maps don't :)

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#45

Post by Tepix »

oneeyedpigeon wrote: post #23
kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> not an easy fix All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.

Completely disabling CSS will make a lot of sites inaccessible. Partly disabling it (for example the #after part) would be interesting...

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#46

Post by Tepix »

avian wrote: post #7
Angostura wrote: post #4

Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

A more interesting question would be if it is possible to disable the "dynamic" part of the CSS in any browser. Things like ":hover", ":active" that this proof of concept abuses and leave just the more benign static styling rules.

Perhaps preventing the loading of URLs in the dynamic parts would be enough?

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#47

Post by mrob »

gsnedders wrote: post #14
kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> * Media query - So what, user agent gives this away mostly anyways It doesn't; without media queries you can't detect thing like browser window size or screen pixel density. > * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) There's a lot of trade-offs here. Plenty of peo…

If somebody has fonts installed for specific reasons then presumably they don't want web pages changing them. Web pages shouldn't need any more control than selecting from "serif", "sans-serif", or "monospace". The most legible font is the font you're most familiar with. I don't want web pages to use different fonts just because some marketing drone thought it was good for branding. It's disappointing that we allowed websites to abuse fonts for vector icons.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#48

Post by ekianjo »

dahart wrote: post #42
keypress wrote: post #37

Earlier quoted context omitted.

Happily used to (5 years ago) surf the web with no JS and no CSS, or rather applying my own style-sheet for 90% of my web viewing. I'd fall back to Chrome when absolutely necessary. It was fast and comfortable, it just relies on well structured accessible content.

> it just relies on well structured accessible content. Honest question: how much of this is left? What popular sites are still accessible this way? HN might be the only site I visit frequently where browsing with no js/css has any hope of working.

Check surfraw (by Assange), you can actually access a surprising amount of resources using sr and lynx from a terminal. Text only, but still makes internet pretty useful.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#49

Post by dahart »

oneeyedpigeon wrote: post #28
SimeVidas wrote: post #5

But how many users disable JavaScript in their browser to prevent tracking? And is the fact that a website can track all your clicks and mouse movements a privacy/security issue to begin with? Isn’t it by design that the website you’re visiting can track you?

> by design By design, the web is a "1. send me the document 2. here it is" transaction, not a series of many small notifications. By design, the url() property almost certainly wasn't intended to be dynamic. This is clearly 'bending the established rules' — cleverly, admittedly.

> By design, the web is a "1. send me the document 2. here it is" transaction, not a series of many small notifications.

That was true in 1998, but most of the web has been turning, by design, into what you might call a series of many small notifications ever since then. Gmail's been doing it since 2004. Today, almost all large sites are running Google Analytics or something like it, which track everything this article discusses, and operates on constant micro transactions. All web apps are built on many small notifications, and many of them even use websockets which was explicitly, by design, built for streams of micro transactions.

> By design, the url() property almost certainly wasn't intended to be dynamic. This is clearly 'bending the established rules'

There was never a rule against, even if dynamic usage wasn't expected or imagined (which I find unlikely). CSS allows it, therefore it's allowed by design.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#50

Post by zerokernel »

kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> * Media query - So what, user agent gives this away mostly anyways

I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device!

Some examples:

Mozilla/5.0 (iPad; CPU OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0 Mobile/14G60 Safari/602.1

Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_1 like Mac OS X) AppleWebKit/604.4.7 (KHTML, like Gecko) iOS/16.0.7.121031 Mobile/15C153 Safari/9537.53

Mozilla/5.0 (Linux; Android 7.0; LG-H840 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36

A Linux in comparison:

Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0

While it includes the version number, no patch level (57.0.X) is included.

Post reply on HN