Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crooked Style Sheeding – Webpage tracking using only CSS

github.com

Post reply on HN
Print view View original

141–150 of 180 posts

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#141

Post by goialoq »

oneeyedpigeon wrote: post #32
kodablah wrote: post #29

Earlier quoted context omitted.

While we, as devs, may get tired of the constant beat-down between site flexibility and privacy, many of our users are unaware. They will go blindly towards flexibility and we have a duty to find as much compromise as possible between those two values lest we just say "it's an easy fix, just turn off your computer". There has to be a middle ground between extremely paranoid turn everything off and extremely liberal w…

I guess my point is "how much anonymity is it reasonable to expect?" Should I have a problem with the fact that nigh-on every URL in the world will leave behind a little footprint when I request it? I don't see an enormous problem with a website anonymously recording the fact that I've clicked a link. ("anonymously" assuming I'm blocking their cookies, which I would if I were that paranoid)

a footprint is not a fingerprint. This whole thread is about non-anonymous tracking.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#142

Post by talmand »

claar wrote: post #101
talmand wrote: post #78

This is an interesting concept, but I'm not seeing anything that couldn't already be done with a properly set up website and server logging. Things like "@supports (-webkit-appearance:none)" doesn't give you chrome detection. It gives you webkit detection, which is a rather large subset of the whole. Plus some of the other browsers started supporting webkit prefixes.

> doesn't give you chrome detection Checking every possible prefix should distinguish most versions of most rendering engines -- still not bad.

It would only, at best, give you outdated browser versions. Unless you are going to create a huge set of rules checking certain properties against other properties. Plus it doesn't tell you which browser, only maybe which webkit engine version. Which tells you next to nothing.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#143

Post by talmand »

kodablah wrote: post #136
talmand wrote: post #69

Earlier quoted context omitted.

>> Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess. >> Unique font names per user seem unnecessary. As a dev that has worked in CSS for over a decade, I have no idea what either of those mean. EDIT: I see the unique font names part now, totally missed that while focusing on the other…

By "CSS property queries" I mean the technique in TFA using @supports + before/after-content URLs to query whether certain CSS properties are supported.

I see my problem now, I don't see @supports as a query like in terms of media queries.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#144

Post by talmand »

CaptSpify wrote: post #99
yoodenvranx wrote: post #96

Earlier quoted context omitted.

> why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know…

As a developer: If we actually pushed browsers to fix things, you wouldn't need to worry about that. Why should the job fall to you to work around their shitty implimentation of the spec?

"Yeah sure thing boss. I'll get on the phone to Microsoft and ask them to fix that issue in IE8 that you insist needs to be supported."

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#145

Post by Raphmedia »

ppeetteerr wrote: post #74
Raphmedia wrote: post #57

Alright lads, let's all go back to RSS feeds and scrap that whole "browser" experiment.

I know this is a joke but you will still have tracking in the rss reader or in the images loaded along side the articles. The only solution is paying for software that does not track.

ASCII art only.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#146

Post by jandrese »

rollcat wrote: post #130
kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) Oh my. I wish this madness ended. Quoth tedu: > I don’t know a whole lot about typography and fonts, but there’s two things I know about font files. They’re ridiculously complex and their parsers have only just begun to exp…

I've thought for some time that the only reason people have not exploited fonts to take over browsers is because even hackers don't understand how they work.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#147

Post by zodPod »

CaptSpify wrote: post #99
yoodenvranx wrote: post #96

Earlier quoted context omitted.

> why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know…

As a developer: If we actually pushed browsers to fix things, you wouldn't need to worry about that. Why should the job fall to you to work around their shitty implimentation of the spec?

Yeah why ask to be empowered to fix your own problems when you could just beg someone else to fix them?

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#148

Post by iapx88 »

Angostura wrote: post #4

Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

> Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

Is it time for a gopher[0] revival?

0 - https://en.wikipedia.org/wiki/Gopher_(protocol)

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#149

Post by sevensor »

dahart wrote: post #42
keypress wrote: post #37

Earlier quoted context omitted.

Happily used to (5 years ago) surf the web with no JS and no CSS, or rather applying my own style-sheet for 90% of my web viewing. I'd fall back to Chrome when absolutely necessary. It was fast and comfortable, it just relies on well structured accessible content.

> it just relies on well structured accessible content. Honest question: how much of this is left? What popular sites are still accessible this way? HN might be the only site I visit frequently where browsing with no js/css has any hope of working.

I browse HN using w3m, from which I'm commenting right now. It works on probably 80% of the links I attempt to visit. In many cases it works better than a graphical browser: I only see article text, and for reasons I haven't investigated I often seem to be ignored by paywalls. I never see subscription nagboxes or ads. Sometimes I have to search forward for the title to skip the load of garbage that precedes the article text.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#150

Post by aglionby »

sorenjan wrote: post #83
zerokernel wrote: post #50

Earlier quoted context omitted.

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…

The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.

Not exactly related to your point about the user agent giving all kinds of arguably unnecessary information, but there's an interesting write-up about why the core user agent is the mess it is for those who've not seen it already.

https://webaim.org/blog/user-agent-string-history/

Post reply on HN