Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crooked Style Sheeding – Webpage tracking using only CSS

github.com

Post reply on HN
Print view View original

91–100 of 180 posts

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#91

Post by _jal »

dahart wrote: post #42
keypress wrote: post #37

Earlier quoted context omitted.

Happily used to (5 years ago) surf the web with no JS and no CSS, or rather applying my own style-sheet for 90% of my web viewing. I'd fall back to Chrome when absolutely necessary. It was fast and comfortable, it just relies on well structured accessible content.

> it just relies on well structured accessible content. Honest question: how much of this is left? What popular sites are still accessible this way? HN might be the only site I visit frequently where browsing with no js/css has any hope of working.

Try it and see. I block a ton by default[1]; most sites are just fine without it.

I get that some people have low tolerances for things not being perfect. CNN stories without JS usually have a pile of empty images at the top, for instance. But that is probably fixable; I just haven't bothered to figure out which bit of JS to allow for that.

Usability depends on your tolerance for imperfections vs. your tolerance for being observed.

[1] Current setup uses JS Blocker 5, uBlock, an aggressive cookie manager and my home proxy, which does a ton of things, many of which I don't even remember at this point.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#92

Post by supermdguy »

nukeop wrote: post #58
supermdguy wrote: post #40

Earlier quoted context omitted.

Wouldn't that require a separate blacklist for each site?

Probably not everyone would be willing to create their own user tracking solutions, most websites use third party analytics, which can be handled by generalized rules. For those that do roll their own solutions, per-website block lists would be needed, but that's how site-specific adblocking already works. The lists are maintained by the community and updated very frequently.

Oh, that's true. I wasn't really thinking about third party solutions.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#93

Post by spladug »

rcxdude wrote: post #16
kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

In the case of reddit, the custom CSS could not reference off-reddit resources (images were uploaded), so this technique would not work.

Yup! And this sort of tracking is exactly why.

https://github.com/reddit/reddit/blob/master/r2/r2/lib/cssfi...

https://www.reddit.com/r/cssnews/comments/24anzb/css_change_...

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#94

Post by cheschire »

asadlionpk wrote: post #15

Interesting trick. But I think adBlockers block requests to entire tracking domains. So even css calls would be blocked?

It’s pretty trivial to make server side calls to google analytics [0] passing lots of different data using async commands so the user doesn’t even feel the hit.

Additionally you could queue these stats messages and send in bulk when your server load falls below a certain threshold. I’m not talking hours, just seconds. Like a workflow engine.

0: https://developers.google.com/analytics/solutions/experiment...

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#95

Post by chatmasta »

I don't see what's problematic about this. The tracking is not really done in CSS, so much as on the server. You could accomplish the same thing with 1x1 images, or loading any remote resource. Effectively the only difference is you're loading the URL conditionally via CSS, as opposed to within a `` or `` tag. Furthermore, this can be blocked in the same way as any tracking URL.

I concede this is a novel way of fingerprinting the browser from within the client, without using JS. However, I think a better way to describe this would be "initiating tracking on the frontend without the use of javascript."

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#96

Post by yoodenvranx »

sorenjan wrote: post #83
zerokernel wrote: post #50

Earlier quoted context omitted.

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…

The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.

> why should any website know all that?

As a developer:

Without user agent: How would I easily detect which browser breaks a certain feature on my project?

If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it.

If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know which browser is responsible for this.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#97

Post by CaptSpify »

sorenjan wrote: post #83
zerokernel wrote: post #50

Earlier quoted context omitted.

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…

The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.

I've always thought this. Just code to the standard, and if the browser doesn't render it correctly, then tell the user to fuck off and fix their browser.

I don't know why we ever thought sending all this data to the server was a good idea

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#99

Post by CaptSpify »

yoodenvranx wrote: post #96
sorenjan wrote: post #83

Earlier quoted context omitted.

The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.

> why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know…

As a developer: If we actually pushed browsers to fix things, you wouldn't need to worry about that. Why should the job fall to you to work around their shitty implimentation of the spec?

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#100

Post by philliphaydon »

oneeyedpigeon wrote: post #32
kodablah wrote: post #29

Earlier quoted context omitted.

While we, as devs, may get tired of the constant beat-down between site flexibility and privacy, many of our users are unaware. They will go blindly towards flexibility and we have a duty to find as much compromise as possible between those two values lest we just say "it's an easy fix, just turn off your computer". There has to be a middle ground between extremely paranoid turn everything off and extremely liberal w…

I guess my point is "how much anonymity is it reasonable to expect?" Should I have a problem with the fact that nigh-on every URL in the world will leave behind a little footprint when I request it? I don't see an enormous problem with a website anonymously recording the fact that I've clicked a link. ("anonymously" assuming I'm blocking their cookies, which I would if I were that paranoid)

I don’t mind sites tracking to know what products sell and what doesn’t, what browsers people use or how Long I spend on the site etc.

What I hate, is the fact that I go to agoda, I search for hotels in jiufen in taiwan, I look at only 2, I book one of the 2, I close it. Open up Facebook on my phone seconds later and have adverts saying: hey how about these 2 hotels in jiufen.

That shit annoys me. Stop following me and tracking what I’m doing and sharing it with all these companies. It makes me want to not use the internet...

Post reply on HN