3 ms·
Even with JS disabled you can still get a lot of these via CSS. Sadly none of these technologies were designed with privacy in mind.
by AnaniasAnanas 8y ago
Even with JS disabled you can still get a lot of these via CSS. Sadly none of these technologies were designed with privacy in mind.
- peterwwillis 8y agoBrowsers are designed for websites to control the user experience, so it's little wonder when there are privacy or security issues
- robin_reala 8y agoNo? There are a couple of CSS privacy leaks, but the vast majority of privacy leaks are through JS.
- AnaniasAnanas 8y agoNot sure what you are saying no to. I did not say anything that contradicts your statement.
- craftyguy 8y ago> Even with JS disabled you can still get a lot of these via CSS.
- AnaniasAnanas 8y agoYes? I don't understand what the issue is.
- quietbritishjim 8y agoCSS can send HTTP requests without JavaScript? How does that work?
- AnaniasAnanas 8y agoYes, it can. Consider https://www.smashingmagazine.com/2014/10/css-only-solution-for-ui-tracking/ https://www.smashingmagazine.com/2014/10/css-only-solution-f... for example.
- quietbritishjim 8y agoThanks! That page does say this: The problem with this kind of CSS UI tracking is that we get only the first occurrence of the event. For example, take the :active pseudo class example. The request for the background image is fired only once. If we need to capture every click then, we have to change the URL, which is not possible without JavaScript. It's also not clear to me how you could capture any keystrokes with this technique. Still, I did find it interesting.
- munk-a 8y agoActually, it appears CSS is getting a new `attr` function, it looks like with that you might be able to just completely break security, consider... input[value] { background-image: attr(value url, 'no-input'); } On a page with some inputs, depending on how the standard evolves that might just start dispatching server requests.
- deleted 8y ago[deleted]