4 ms·

You may also need to disable CSS. <style> a:active { background-image: url(tracking...); } </style>

by geocar 8y ago

danShumway 8y ago
I just tested this in Firefox. If the request isn't cached, it just immediately times out as soon as the page load begins. I haven't tested to see if it still gets delivered to the server. If the browser is sending out the request and just not waiting for a response, then it would still be usable. It's still worth noting though that in either case this is a way more complicated attack than adding a ping attribute. With the ping attribute, you don't have to worry about browser caching because you're using a post request. If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. You also need to worry about false positives and false negatives -- a user clicking on a link and then dragging off of it without visiting will still trigger your tracking code, and a user navigating via keyboard controls won't trigger this at all. None of that is to say that CSS tracking isn't something we should worry about (for instance, I really wish Firefox disabled `visited` styling by default), but I don't think this is an effective argument for saying that we should just give up and make tracking even easier (not that parent is claiming this). And in any case, it's also not like it would be exactly hard for a future version of Firefox to add an option that disabled `active` styling specifically for link tags. Tracking protection is a game of cat and mouse. We patch things as we go.
- geocar 8y ago
  > I haven't tested to see if it still gets delivered to the server. I have, and it does.
- minitech 8y ago
  > If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. Or serve Cache-Control: no-cache?
  - danShumway 8y ago
    Correct, this is a good catch. If you're serving your background image from a server that lets you set headers (which you would want to since it's a tracking beacon) then using headers makes this a lot easier.

You may also need to disable CSS. <style> a:active { background-image: url(tracking...); } </style>

by geocar 8y ago

You may also need to disable CSS. <style> a:active { background-image: url(tracking...); } </style>

I just tested this in Firefox. If the request isn't cached, it just immediately times out as soon as the page load begins. I haven't tested to see if it still gets delivered to the server. If the browser is sending out the request and just not waiting for a response, then it would still be usable. It's still worth noting though that in either case this is a way more complicated attack than adding a ping attribute. With the ping attribute, you don't have to worry about browser caching because you're using a post request. If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. You also need to worry about false positives and false negatives -- a user clicking on a link and then dragging off of it without visiting will still trigger your tracking code, and a user navigating via keyboard controls won't trigger this at all. None of that is to say that CSS tracking isn't something we should worry about (for instance, I really wish Firefox disabled `visited` styling by default), but I don't think this is an effective argument for saying that we should just give up and make tracking even easier (not that parent is claiming this). And in any case, it's also not like it would be exactly hard for a future version of Firefox to add an option that disabled `active` styling specifically for link tags. Tracking protection is a game of cat and mouse. We patch things as we go.

geocar 8y ago
> I haven't tested to see if it still gets delivered to the server. I have, and it does.
minitech 8y ago
> If you want to get rid of caching with the CSS method, you either need to switch to serverside rendering (which blocks you from using static hosts like Github pages) or have Javascript enabled so you can generate the CSS on the fly. Or serve Cache-Control: no-cache?
- danShumway 8y ago
  Correct, this is a good catch. If you're serving your background image from a server that lets you set headers (which you would want to since it's a tracking beacon) then using headers makes this a lot easier.