4 ms·

Yes, unless JS is disabled, now even disabling JS isn't enough. This move sucks hard. Please, everyone, move to Firefox now, even if it's only for personal brow

by kgwxd 8y ago

Yes, unless JS is disabled, now even disabling JS isn't enough. This move sucks hard. Please, everyone, move to Firefox now, even if it's only for personal browsing (use what you must for work), and write a strongly worded message to the maker of the browser you are leaving.

TheAceOfHearts 8y ago
If you have JavaScript disabled they can still redirect you through a portal page to capture your visit and then send you to the actual link.
- timwis 8y ago
  not if your computer's off tho
- Grollicus 8y ago
  But that means they have to send links to the tracking page, that will show the tracking page on hover as the link destination etc. That is much more noticeable than sending a link that shows www.google.com but instead goes somewhere else on click.
- kgwxd 8y ago
  That's transparent. They're claiming this is more transparent when it's not transparent at all. The browser is supposed to be a user agent, not a corporate lackey.
geocar 8y ago
You may also need to disable CSS. <style> a:active { background-image: url(tracking...); } </style>
- danShumway 8y ago
  I just tested this in Firefox. If the request isn't cached, it just immediately times out as soon as the page load begins. I haven't tested to see if it still gets delivered to the server. If the browser is sending out the request and just not waiting for a response, then it would still be usable. It's still worth noting though that in either case this is a way more complicated attack than adding a ping attribute. With the ping attribute, you don't have to worry about browser caching because you're using a post request. If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. You also need to worry about false positives and false negatives -- a user clicking on a link and then dragging off of it without visiting will still trigger your tracking code, and a user navigating via keyboard controls won't trigger this at all. None of that is to say that CSS tracking isn't something we should worry about (for instance, I really wish Firefox disabled `visited` styling by default), but I don't think this is an effective argument for saying that we should just give up and make tracking even easier (not that parent is claiming this). And in any case, it's also not like it would be exactly hard for a future version of Firefox to add an option that disabled `active` styling specifically for link tags. Tracking protection is a game of cat and mouse. We patch things as we go.
  - geocar 8y ago
    > I haven't tested to see if it still gets delivered to the server. I have, and it does.
  - minitech 8y ago
    > If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. Or serve Cache-Control: no-cache?
    - danShumway 8y ago
      Correct, this is a good catch. If you're serving your background image from a server that lets you set headers (which you would want to since it's a tracking beacon) then using headers makes this a lot easier.

by kgwxd 8y ago

TheAceOfHearts 8y ago

If you have JavaScript disabled they can still redirect you through a portal page to capture your visit and then send you to the actual link.

timwis 8y ago
not if your computer's off tho
Grollicus 8y ago
But that means they have to send links to the tracking page, that will show the tracking page on hover as the link destination etc. That is much more noticeable than sending a link that shows www.google.com but instead goes somewhere else on click.
kgwxd 8y ago
That's transparent. They're claiming this is more transparent when it's not transparent at all. The browser is supposed to be a user agent, not a corporate lackey.

geocar 8y ago

You may also need to disable CSS. <style> a:active { background-image: url(tracking...); } </style>

danShumway 8y ago
I just tested this in Firefox. If the request isn't cached, it just immediately times out as soon as the page load begins. I haven't tested to see if it still gets delivered to the server. If the browser is sending out the request and just not waiting for a response, then it would still be usable. It's still worth noting though that in either case this is a way more complicated attack than adding a ping attribute. With the ping attribute, you don't have to worry about browser caching because you're using a post request. If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. You also need to worry about false positives and false negatives -- a user clicking on a link and then dragging off of it without visiting will still trigger your tracking code, and a user navigating via keyboard controls won't trigger this at all. None of that is to say that CSS tracking isn't something we should worry about (for instance, I really wish Firefox disabled `visited` styling by default), but I don't think this is an effective argument for saying that we should just give up and make tracking even easier (not that parent is claiming this). And in any case, it's also not like it would be exactly hard for a future version of Firefox to add an option that disabled `active` styling specifically for link tags. Tracking protection is a game of cat and mouse. We patch things as we go.
- geocar 8y ago
  > I haven't tested to see if it still gets delivered to the server. I have, and it does.
- minitech 8y ago
  > If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. Or serve Cache-Control: no-cache?
  - danShumway 8y ago
    Correct, this is a good catch. If you're serving your background image from a server that lets you set headers (which you would want to since it's a tracking beacon) then using headers makes this a lot easier.