5 ms·

What extra data can you track using this method over just normal HTTP logging? The only things I can think of are how a user interacts with a page - I don't pa

What extra data can you track using this method over just normal HTTP logging? The only things I can think of are how a user interacts with a page - I don't particularly think this is too concerning - although as with all these things there are possibly much more creative uses of it that I haven't considered. There's a new image property loading="lazy" which generally will load an image when it approaches the viewport. This could also be "abused" in similar ways. If this does turn out to be a privacy concern, browser settings/privacy addons could simply load all lazy images or images refered to in CSS/JS files on load which would nullify this technique.

lawik 6y ago
You can mostly track the interactions. Just the fact that CSS was loaded distinguishes the user from a lot of automated tracking. You should be able to track time spent on the page with CSS animations as well, up to a point, that's mentioned in the post. I don't think you can do anything particularly nasty even with CSS variable programming which can apparently be used for interactive games (https://github.com/propjockey/css-sweeper https://github.com/propjockey/css-sweeper). As I looked into things writing for this post I couldn't come up with a non-JS way to transition much significant data into CSS.
- TomGullen 6y ago
  HTTP logging can give a pretty strong indicator of time spent on pages (not perfect, but good with large volumes) as well as navigated routes through the site already. It would seem to me that the only advantage of this technique is to track mouse movements on the page in a very low resolution, and likely labour intensive way. Low resolution because it only works the first time on each page load, and is going to be tricky to get any meaningful granularity on the data. I am not particularly concerned about this but my privacy concerns are definitely lower than the general consensus of this site. I only compare to HTTP logging as this is the most hidden/covert way of tracking users.
  - lknik 6y ago
    I used this (via :hover) to play with mouse movement tracking. The resolution was significantly worse than the JS approach. But it worked, and even allowed to use some ML analysis on mouse movement patterns. That was about 10 years ago, so I no longer have the code/site.
  - thdrdt 6y ago
    Another trick is to use JavaScript to check if images have a size. Most bots don't download those assets to save bandwith.
dangerface 6y ago
You can use CSS to identify fonts and feature detection like Modernizr to uniquely identify browsers and users. Track clicks, mouse over, language, screen size, time spent can be calculated with animations, pretty much anything you would do with javascript except canvas fingerprinting. The big advantage of this is that you can still track and uniquely identify people even if they turn off cookies and javascript.
jedimastert 6y ago
There are probably quite a few fingerprinting surfaces you could pull out of CSS. For example (these are educated guesses): * Track what fonts a user has installed by asking for preinstalled fonts and using loaded fonts as a fallback * Track screen width and height by conditionally loading an image * Track screen height vs window height (linked to OS and various user settings)
thehappypm 6y ago
By “normal HTTP logging” what do you mean exactly? Most logging is done with JavaScript, and this is JS-free, would even work in an environment with JS disabled.
- foxhop 6y ago
  HTTP logging is what an HTTP server does. It doesn't require JavaScript. Fetching a resource with "HTTP Access Logs" enabled on a server will indicate the what and who, if configured properly. The logs typically end up in a file on the server's filesystem.
  - thehappypm 6y ago
    Thanks for clarifying — but this doesn’t seem particularly useful for many types of tracking. Measuring things like bounces, scroll depth, engagement on modules, etc, require logging post-load.
myfonj 6y ago
Generally yes, if you stick just to CSS you can log HTTP request initiated by user's interaction or user's environment. To name some environmental: locally installed fonts, viewport dimensions, colour depth, resolution etc. Interaction is anything pointer position related, focus management, and to some degree you can do simple kind of "keylogging" or text character presence detection. https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets https://news.ycombinator.com/item?id=16157773 https://news.ycombinator.com/item?id=16157773
earthboundkid 6y ago
Firefox won't do lazy loading if JS is disabled, because it doesn't want lazy loading to work as a fallback page depth tracker. If JS is enabled, all bets are off, so there's not much point in using lazy loading instead of just polling/intersection observer.
eloff 6y ago
Almost nobody turns off JavaScript because it breaks the whole web. You can't even view YouTube. This is less interesting than existing JavaScript techniques to identify or filter out crawlers. It works, when the image is not cached, but it's fundamentally inferior to anything you can do with JavaScript, and if you don't have JavaScript at all, I don't see why you would want to care. Just lump that little bit of traffic in with the bots for analytics purposes.
- Hnrobert42 6y ago
  I use NoScript and only turn on Javascript if I have to. It happens less often than you think. Most sites will load enough for you to read them without JS.
Kalekoa 6y ago
Wondering the same thing.
sloshnmosh 6y ago
You can disable lazy loading images in about:config in Firefox
dwild 6y ago
> The only things I can think of are how a user interacts with a page - I don't particularly think this is too concerning Except that many people don't want others to know how much they read something... I don't care, but many believe that is private. > If this does turn out to be a privacy concern, browser settings/privacy addons could simply load all lazy images or images refered to in CSS/JS files on load which would nullify this technique. So you load more invisible pixel and make this even more effective as now you'll be able to get much more granular data, like the scroll position!

lawik 6y ago

You can mostly track the interactions. Just the fact that CSS was loaded distinguishes the user from a lot of automated tracking. You should be able to track time spent on the page with CSS animations as well, up to a point, that's mentioned in the post. I don't think you can do anything particularly nasty even with CSS variable programming which can apparently be used for interactive games (https://github.com/propjockey/css-sweeper https://github.com/propjockey/css-sweeper). As I looked into things writing for this post I couldn't come up with a non-JS way to transition much significant data into CSS.

TomGullen 6y ago
HTTP logging can give a pretty strong indicator of time spent on pages (not perfect, but good with large volumes) as well as navigated routes through the site already. It would seem to me that the only advantage of this technique is to track mouse movements on the page in a very low resolution, and likely labour intensive way. Low resolution because it only works the first time on each page load, and is going to be tricky to get any meaningful granularity on the data. I am not particularly concerned about this but my privacy concerns are definitely lower than the general consensus of this site. I only compare to HTTP logging as this is the most hidden/covert way of tracking users.
- lknik 6y ago
  I used this (via :hover) to play with mouse movement tracking. The resolution was significantly worse than the JS approach. But it worked, and even allowed to use some ML analysis on mouse movement patterns. That was about 10 years ago, so I no longer have the code/site.
- thdrdt 6y ago
  Another trick is to use JavaScript to check if images have a size. Most bots don't download those assets to save bandwith.

dangerface 6y ago

You can use CSS to identify fonts and feature detection like Modernizr to uniquely identify browsers and users. Track clicks, mouse over, language, screen size, time spent can be calculated with animations, pretty much anything you would do with javascript except canvas fingerprinting. The big advantage of this is that you can still track and uniquely identify people even if they turn off cookies and javascript.

jedimastert 6y ago

There are probably quite a few fingerprinting surfaces you could pull out of CSS. For example (these are educated guesses): * Track what fonts a user has installed by asking for preinstalled fonts and using loaded fonts as a fallback * Track screen width and height by conditionally loading an image * Track screen height vs window height (linked to OS and various user settings)

thehappypm 6y ago

By “normal HTTP logging” what do you mean exactly? Most logging is done with JavaScript, and this is JS-free, would even work in an environment with JS disabled.

foxhop 6y ago
HTTP logging is what an HTTP server does. It doesn't require JavaScript. Fetching a resource with "HTTP Access Logs" enabled on a server will indicate the what and who, if configured properly. The logs typically end up in a file on the server's filesystem.
- thehappypm 6y ago
  Thanks for clarifying — but this doesn’t seem particularly useful for many types of tracking. Measuring things like bounces, scroll depth, engagement on modules, etc, require logging post-load.

myfonj 6y ago

Generally yes, if you stick just to CSS you can log HTTP request initiated by user's interaction or user's environment. To name some environmental: locally installed fonts, viewport dimensions, colour depth, resolution etc. Interaction is anything pointer position related, focus management, and to some degree you can do simple kind of "keylogging" or text character presence detection. https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets https://news.ycombinator.com/item?id=16157773 https://news.ycombinator.com/item?id=16157773

earthboundkid 6y ago

Firefox won't do lazy loading if JS is disabled, because it doesn't want lazy loading to work as a fallback page depth tracker. If JS is enabled, all bets are off, so there's not much point in using lazy loading instead of just polling/intersection observer.

eloff 6y ago

Almost nobody turns off JavaScript because it breaks the whole web. You can't even view YouTube. This is less interesting than existing JavaScript techniques to identify or filter out crawlers. It works, when the image is not cached, but it's fundamentally inferior to anything you can do with JavaScript, and if you don't have JavaScript at all, I don't see why you would want to care. Just lump that little bit of traffic in with the bots for analytics purposes.

Hnrobert42 6y ago
I use NoScript and only turn on Javascript if I have to. It happens less often than you think. Most sites will load enough for you to read them without JS.

Kalekoa 6y ago

Wondering the same thing.

sloshnmosh 6y ago

You can disable lazy loading images in about:config in Firefox

dwild 6y ago

> The only things I can think of are how a user interacts with a page - I don't particularly think this is too concerning Except that many people don't want others to know how much they read something... I don't care, but many believe that is private. > If this does turn out to be a privacy concern, browser settings/privacy addons could simply load all lazy images or images refered to in CSS/JS files on load which would nullify this technique. So you load more invisible pixel and make this even more effective as now you'll be able to get much more granular data, like the scroll position!