Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crooked Style Sheeding – Webpage tracking using only CSS

github.com

Post reply on HN
Print view View original

51–60 of 180 posts

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#51

Post by Klathmon »

Tepix wrote: post #46
avian wrote: post #7

Earlier quoted context omitted.

A more interesting question would be if it is possible to disable the "dynamic" part of the CSS in any browser. Things like ":hover", ":active" that this proof of concept abuses and leave just the more benign static styling rules.

Perhaps preventing the loading of URLs in the dynamic parts would be enough?

Probably not, you'd also need to disable a lot of other optimizations.

For example, a browser will not load an image if it's set to `display: none` in CSS (at least not right away). That could be abused to then trigger the download when CSS changes without a URL needing to be on the CSS at any point.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#53

Post by pbhjpbhj »

yorwba wrote: post #26
Angostura wrote: post #4

Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

Using lynx, the only thing that makes reading Hacker News somewhat inconvenient is the lack of indentation to show the nesting hierarchy, but otherwise it works quite well. Some other sites are so messed up that it's actually more comfortable to read them in a text-only browser that completely ignores CSS and replaces images by their alt-tags. Of course I frequently do want to look at images, so my main browser remai…

Links (a fork of lynx IIRC) does images, it might be off by default, can't recall. Back when I used Slackware it was handy to have a terminal based browser for looking up how to fix things.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#54

Post by zerokernel »

oneeyedpigeon wrote: post #23
kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> not an easy fix All of this is an easy fix: disable css. In the same way that "I don't want to be tracked by javascript" can easily be resolved by disabling javascript. I'm not seriously suggesting everyone does that, but anyone who is so paranoid that they don't want a site knowing that they're reading its content might want to consider it.

That's pretty much the "reader mode" available in some browsers, no?

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#56

Post by dahart »

kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> If you're concerned as a user of a malicious site

Or if you're concerned as a user of a regular "safe" site... Google Analytics does all of these things: link tracking, hover tracking, media query tracking. GA or something like it is being used by vast swaths of the web. I don't claim it's the majority, because I don't know, but that's what I assume, that all sites are tracking (whether or not the site even knows it.)

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#58

Post by nukeop »

supermdguy wrote: post #40
nukeop wrote: post #30

The obvious solution is to block the server-side pages that the CSS elements link to. This kind of tracking can be mitigated the same way any other kind of tracking is already handled by uBlock or uMatrix.

Wouldn't that require a separate blacklist for each site?

Probably not everyone would be willing to create their own user tracking solutions, most websites use third party analytics, which can be handled by generalized rules. For those that do roll their own solutions, per-website block lists would be needed, but that's how site-specific adblocking already works. The lists are maintained by the community and updated very frequently.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#59

Post by mistersquid »

At least in Safari 11.0.2 (macOS 10.12.6) link tracking does not work. The selector

  #link2:active::after
appears to always exist in Safari 11.0.2 ("active" is being disregarded).

I clicked on none of those links, I have never visited google.de, but results.php page told me all 3 links had been clicked.

EDIT: formatting, remove word.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#60

Post by Daycrawler »

kodablah wrote: post #13

If you're concerned as a user of a malicious site: * Link click tracking - So what, the site could route you through a server side proxy anyways * Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix * Media query - So what, user agent gives this away mostly anyways * Font checking - Can help fingerprinting...browsers need to start r…

> So what, the site could route you through a server side proxy anyways

There's little interest in proxying through a token system (this would require a DB read at each click, and a DB write at each page generation), which means the actual link is available client-side and the whole thing can be bypassed.

Post reply on HN