Crooked Style Sheeding – Webpage tracking using only CSS • Hacker News Board

Crooked Style Sheeding – Webpage tracking using only CSS

#1

Post by ProfDreamer » Tue, Jan 16, 2018, 12:46 PM UTC

Crooked Style Sheeding – Webpage tracking using only CSS
github.com

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#2

Post by Trufa » Tue, Jan 16, 2018, 1:16 PM UTC

Very interesting, it's always intriguing to see how much of a cat and mouse game this privacy stuff is. I'm always thinking that this needs an overhaul and slightly different approach altogether, sadly I can't produce any viable solutions.

With this huge and complex kind of issues I don't think we have to find one solution but rather point in the right direction, but I'm not even sure we're doing that.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#3

Post by en-us » Tue, Jan 16, 2018, 1:18 PM UTC

Well this is depressing.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#4

Post by Angostura » Tue, Jan 16, 2018, 1:18 PM UTC

Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#5

Post by SimeVidas » Tue, Jan 16, 2018, 1:18 PM UTC

But how many users disable JavaScript in their browser to prevent tracking? And is the fact that a website can track all your clicks and mouse movements a privacy/security issue to begin with? Isn’t it by design that the website you’re visiting can track you?

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#6

Post by shove » Tue, Jan 16, 2018, 1:20 PM UTC

Reminds me of similar techniques that could be used several years ago to sniff browser history via a collection of a:visited rules.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#7

Post by avian » Tue, Jan 16, 2018, 1:25 PM UTC

Angostura wrote: post #4

Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

A more interesting question would be if it is possible to disable the "dynamic" part of the CSS in any browser. Things like ":hover", ":active" that this proof of concept abuses and leave just the more benign static styling rules.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#8

Post by vnchr » Tue, Jan 16, 2018, 1:26 PM UTC

Angostura wrote: post #4

Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

Blind users can’t be seen.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#9

Post by shirian » Tue, Jan 16, 2018, 1:28 PM UTC

Angostura wrote: post #4

Whose going to be first to make the 'I always browse the Web with CSS disabled' post?

Or, at least, disabling `url()` in CSS.

Re: Crooked Style Sheeding – Webpage tracking using only CSS

#10

Post by andrewmcwatters » Tue, Jan 16, 2018, 1:28 PM UTC

Any part of a browser that can make a request can be used to do this sort of thing. Any part of a browser that can alter the view and its related DOM attributes can cause a user to interact with it and give up data involuntarily.

Turn off JavaScript and CSS media queries can cause resources to load based on a number of parameters. Have canvas enabled and you can be fingerprinted. Use one browser over another and get feature detected. Anchor states give away browsing history. Hell even your IP address sacrifices privacy, and that's before the page gets rendered.

So with that being said, if you're browsing the web, you're giving up information.