4 ms·
Yes, it can. Consider https://www.smashingmagazine.com/2014/10/css-only-solution-for-ui-tracking/ https://www.smashingmagazine.com/2014/10/css-only-solution-f..
by AnaniasAnanas 8y ago
Yes, it can. Consider https://www.smashingmagazine.com/2014/10/css-only-solution-for-ui-tracking/ https://www.smashingmagazine.com/2014/10/css-only-solution-f... for example.
- quietbritishjim 8y agoThanks! That page does say this: The problem with this kind of CSS UI tracking is that we get only the first occurrence of the event. For example, take the :active pseudo class example. The request for the background image is fired only once. If we need to capture every click then, we have to change the URL, which is not possible without JavaScript. It's also not clear to me how you could capture any keystrokes with this technique. Still, I did find it interesting.
- munk-a 8y agoActually, it appears CSS is getting a new `attr` function, it looks like with that you might be able to just completely break security, consider... input[value] { background-image: attr(value url, 'no-input'); } On a page with some inputs, depending on how the standard evolves that might just start dispatching server requests.