3 ms·
You can write a keylogger in pure CSS
- AllegedAlec 9y agoWhy does CSS even have access to this stuff?
- odabaxok 9y agoDupe: https://news.ycombinator.com/item?id=16422696 https://news.ycombinator.com/item?id=16422696
- nukeop 9y agoI don't see how this is an attack unless you load random third party stylesheets yourself. It's the webmaster's role to ensure that css sheets included on the website do not contact dodgy third party domains. It also won't work on vanilla html inputs, it has to be controlled by javascript in which case the javascript already has access to this information anyway (and much more).
- HugThem 9y agoNo, you can't. You can uses CSS as part of a keylogger in conjunction with Javascript that triggers your selectors based on keypresses. There are sites that already ship javascript that change attributes that trigger selectors on certain keypress events. So by adding 'pure css' to these sites one would be able to log keystrokes on certain fields. One example is Instagram. It ships Javascript that changes suitable attributes of the password field on every keystroke. So adding the right CSS to Instagram could result in passwords being logged.
- gmueckl 9y agoDoes anyone know how this interacts with form auto-filling?
- petraeus 9y ago*with the use of JS