Crooked Style Sheeding – Webpage tracking using only CSS • Hacker News Board

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#161

Post by fixermark » Tue, Jan 16, 2018, 9:44 PM UTC

CaptSpify wrote: post #159

fixermark wrote: post #120

Earlier quoted context omitted.

if 99% of websites you visit work great, and 1 website you visit tells you to fuck off and fix your browser, are you going to do that or are you going to just not use that site? Remember: incentives. The goal of a web developer is to make sites people use.

Yeah, I would just leave that site. But if you implement that feature using known simple and stable, tech, you wont really have that problem. > Remember: incentives. The goal of a web developer is to make sites people use. The goal should be to empower users. Anyone can make a site that people "use"

Does empowering users get the web developer paid?

I mean, in an ideal world, of course it does. But again: incentives. Keep in mind: search engines themselves are extremely empowering, and they are not generally considered to be something a person pays directly for.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#162

Post by whatismybrowser » Tue, Jan 16, 2018, 10:20 PM UTC

sorenjan wrote: post #83

zerokernel wrote: post #50

Earlier quoted context omitted.

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…

The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.

The user agent string definitely has a place on the web, the problem is that it's been used and abused by web developers in the 90s and 2000s when trying to deal with the utter mess that was "browser compatibility" back then.

I run whatismybrowser.com and it's a perfect case of why user agents are useful information. It'll tell you what browser you've got, what OS, and whether you're up to date or not. It's extremely useful to know this info when helping non-tech users - you would not believe how many people still reply "I just click the internet" when you ask them what browser they're using. My site helps answer all those complicated "first" questions.

I completely agree that using User Agents for feature detection/brower compatibilty is a terrible idea, but apparently enough websites still do it to warrant having to keep all that useless, contraditory mumbo jumbo in it too - it isn't what they should be used for any more!

And also, I don't think there's any problem with including "too much" information in the user agent either - point in case: Firefox used to include the full version number of Firefox in the user agent, but now it only shows the major version number, not the exact revision etc. The problem is I can no longer perfectly warn users if they're actually up to date or not.

The reasoning for this is given as a security concern, which I still don't understand - if there's a security problem in a particular point-revision version of Firefox which can be exploited by a malicious web server - odds are they're just going to try that exploit for any version of firefox and it either will or won't work - how does the malicious site knowing the exact version make the situation any worse?!

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#163

Post by talmand » Tue, Jan 16, 2018, 11:12 PM UTC

CaptSpify wrote: post #155

talmand wrote: post #144

Earlier quoted context omitted.

"Yeah sure thing boss. I'll get on the phone to Microsoft and ask them to fix that issue in IE8 that you insist needs to be supported."

So you think a better way is spending your evening trying to fix your square pegs so that they fit in round holes? Why would you willingly do that to yourself? If we pushed browser developers to actually do their job, they wouldnt be pushing their weight around like they do now.

I have to assume you are trolling at this point.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#164

Post by seandougall » Wed, Jan 17, 2018, 1:03 AM UTC

CaptSpify wrote: post #153

gizmo385 wrote: post #105

Earlier quoted context omitted.

Because when management asks you why their site that they paid hundreds of thousands of dollars for doesn't work on , your answer can't be "the browser's implementation of the spec is shitty, blame them." Your answer is going to be, "Yeah, sure, let me fix that."

Well, your answer should be: I'll reimpliment it using known, simple, stable technologies. But for some reason our industry hates those things.

So... not the web, then? :-P

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#165

Post by 8note » Wed, Jan 17, 2018, 1:53 AM UTC

kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

link 0 is inaccurate. Reddit retracted that statement on CSS, saying mod created styles will stick around.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#166

Post by matte_black » Wed, Jan 17, 2018, 1:57 AM UTC

gizmo385 wrote: post #105

CaptSpify wrote: post #99

Earlier quoted context omitted.

As a developer: If we actually pushed browsers to fix things, you wouldn't need to worry about that. Why should the job fall to you to work around their shitty implimentation of the spec?

Because when management asks you why their site that they paid hundreds of thousands of dollars for doesn't work on , your answer can't be "the browser's implementation of the spec is shitty, blame them." Your answer is going to be, "Yeah, sure, let me fix that."

Don’t forget “Also, it’s going to cost $X more.”

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#167

Post by NegativeLatency » Wed, Jan 17, 2018, 2:41 AM UTC

sorenjan wrote: post #83

zerokernel wrote: post #50

Earlier quoted context omitted.

> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…

The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.

Google makes the OS, but they also sell ads. Seems pretty advantageous to them to make their devices easy to fingerprint.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#168

Post by bzbarsky » Wed, Jan 17, 2018, 2:44 AM UTC

rollcat wrote: post #130

kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most) Oh my. I wish this madness ended. Quoth tedu: > I don’t know a whole lot about typography and fonts, but there’s two things I know about font files. They’re ridiculously complex and their parsers have only just begun to exp…

Note that browsers pass downloadable fonts through a sanitizer before they even consider handing them off to anything else that might need to parse the font. And browser security teams have spent years now fuzzing both those sanitizers and various font libraries...

There's still a lot of attack surface here, but "only just begun to experience life with hostile inputs" isn't quite true either.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#169

Post by jrochkind1 » Wed, Jan 17, 2018, 3:45 AM UTC

kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

Sure. I think it's mainly interesting in that CSS injection vulnerability can turn into tracking. it never occurred to me that a CSS injection vulnerability could do anything actionable before.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#170

Post by antibland » Wed, Jan 17, 2018, 6:35 AM UTC

About 8 years ago, a colleague and I interviewed a nervous kid fresh from undergrad. He was applying for a junior front-end position at our fast-growing startup. Dressed in a shiny, double-breasted suit and wingtip shoes, he followed us into a tiny office (space was so limited) where we conducted interviews.

"Tell us about your CSS experience," we asked him.

"Ah, yes. I, well, haha, of course. The CSS is where you make your calls, to the database, ah, server, ah, of course."

Unsurprisingly, we did not hire the applicant, though his answer to our question lived on in infamy for many years. But all that changed, today, reading this. The joke was on us. That kid was clearly from a future of which we had no awareness. Starting today, I'll always trust programmer applicants donning double-breasted suits.