Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A CSS Keylogger

github.com

Post reply on HN
Print view View original

51–60 of 173 posts

Re: Show HN: A CSS Keylogger

#51

Post by notahacker »

dmitrygr wrote: post #34
Raphmedia wrote: post #28

Earlier quoted context omitted.

Browser support (not using Flexbox because of IE) is not that hard once you get your head around it: view-source: http://alistapart.com/d/holygrail/example_3.html http://alistapart.com/d/holygrail/example_3.html

Falls apart entirely on phones (tiny columns of one word wide each, AND horizontal scrolling), so you only proved OP's point...

In fairness, that was written in 2006 when people browsing the internet on their dumbphones generally got served entirely different web pages. And you could fix it with media queries. But the fact that it needed hacky stuff like arbitrarily large positive padding and negative margin values to achieve a "holy grail" of the standard way websites had been laid out using tables for the previous decade or so didn't reflect very well on CSS spec drafters or the browser vendors of the time.

Re: Show HN: A CSS Keylogger

#52

Post by Raphmedia »

maxchehab wrote: post #13
Raphmedia wrote: post #8

I can't seem to make it work from a web page. Perhaps it's for extensions only? https://jsfiddle.net/tdwsw6zo/3/

Your background-image url must be an endpoint that can process a request. Simply, requesting a placehold.it/a image is pointless, but sending to l33thacker.com/a, assuming that l33thacker.com knows how to process that request maliciously, will work.

But you would still see the network call to placehold.it/ if it actually worked.

Re: Show HN: A CSS Keylogger

#53

Post by bfred_it »

maxchehab wrote: post #45
AndrewStephens wrote: post #36

This is neat but doesn't really work as an attack. The CSS selectors work on the value HtmlNode attribute rather than the Javascript "value" value, which aren't linked normally. The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me. [edit] Other people pointed this out first. Also, if you are going to all the trouble of making an extension…

Javascript can be blocked from chrome extensions. In fact, Instagram does block javascript. However, clearly css is not blocked.

What do you mean by "Instagram does block javascript"? What JS does it block?

Re: Show HN: A CSS Keylogger

#54

Post by criswell »

oblosys wrote: post #39
rickdmer wrote: post #3

Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value

If you use React, updating the value on every change is a very common pattern.

Hopefully most are updating the property and not the attribute.

Re: Show HN: A CSS Keylogger

#55

Post by Raphmedia »

notahacker wrote: post #51
dmitrygr wrote: post #34

Earlier quoted context omitted.

Falls apart entirely on phones (tiny columns of one word wide each, AND horizontal scrolling), so you only proved OP's point...

In fairness, that was written in 2006 when people browsing the internet on their dumbphones generally got served entirely different web pages. And you could fix it with media queries. But the fact that it needed hacky stuff like arbitrarily large positive padding and negative margin values to achieve a "holy grail" of the standard way websites had been laid out using tables for the previous decade or so didn't reflec…

To be honest, nothing ever stopped anyone from using display:table;, display:table-row; and display:table-cell;

Re: Show HN: A CSS Keylogger

#56

Post by blixt »

teilo wrote: post #44

This has nothing to do with vulnerabilities in CSS or Javascript. It has to do with ill-conceived authentication implementations, written in Javascript, that save passwords in the DOM using attributes that are then accessible via CSS. That is a vulnerability on the website itself. It is also an idiotic thing to do.

I wouldn't be so dismissive about this. It doesn't really matter what bucket this security issue falls under. It also doesn't change much whether it's "idiotic" or not.

The fact remains that the coding practices on a website used by about a billion people open up for part 1 of this vulnerability (these CSS styles on Instagram do load external resources as you type), and there are plenty of ways for part 2 (inject the CSS) to occur on many less well maintained sites.

Re: Show HN: A CSS Keylogger

#57

Post by cag_ii »

gsnedders wrote: post #47
dmitrygr wrote: post #31

Earlier quoted context omitted.

No, since it matches only the last character, you watch the requests it makes IN order to get the entire password. As you type "qwerty", it will request "Q", "W", "E", "R", "T", and finally "Y" no permutations needed

Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.

It'd be simple enough to add an 'order' identifier (request timestamp, etc) to the requests.

Edit: nm. My mistake, not as easy as that using only css!

Re: Show HN: A CSS Keylogger

#58

Post by usrusr »

cag_ii wrote: post #57
gsnedders wrote: post #47

Earlier quoted context omitted.

Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.

It'd be simple enough to add an 'order' identifier (request timestamp, etc) to the requests. Edit: nm. My mistake, not as easy as that using only css!

Simple enough, in CSS?

Re: Show HN: A CSS Keylogger

#59

Post by notahacker »

Raphmedia wrote: post #55
notahacker wrote: post #51

Earlier quoted context omitted.

In fairness, that was written in 2006 when people browsing the internet on their dumbphones generally got served entirely different web pages. And you could fix it with media queries. But the fact that it needed hacky stuff like arbitrarily large positive padding and negative margin values to achieve a "holy grail" of the standard way websites had been laid out using tables for the previous decade or so didn't reflec…

To be honest, nothing ever stopped anyone from using display:table;, display:table-row; and display:table-cell;

This probably is the most robust solution now, but IE6 mattered then, and it didn't even work in the shiny new IE7

Re: Show HN: A CSS Keylogger

#60

Post by theandrewbailey »

jakobegger wrote: post #40
theandrewbailey wrote: post #24

Earlier quoted context omitted.

Is there even a use case where CSS needs to read any field's value? (Checkboxes and radio buttons have :checked.)

Something like conditional formatting maybe? Eg. make negative values red? Make an input field red when it contains an invalid character?

Sounds like the pattern attribute and :invalid selector on will do that.

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/in...

Post reply on HN