4 ms·

It's kinda bad for multiple reasons... .) definitely an abuse of CSS, which is meant for visual styling .) invisible to the user, can't even be blocked with n

by hooby 6y ago

It's kinda bad for multiple reasons... .) definitely an abuse of CSS, which is meant for visual styling .) invisible to the user, can't even be blocked with noScript (blocking all JS), and blocking CSS would make most sites unusable or at least less than "human readable" .) could be used to track and record a lot of information that does qualify as non-anonymous, personal data (in combination with IP address and timestamp) .) probably illegal according to the GDPR, unless you fully inform the user and get their consent first (before loading the CSS) - and allow them to opt out.

dgellow 6y ago
What personal information do you get that would be different from the HTTP requests sent by the browser to load the page in the first place?
- hooby 6y ago
  It's absolutely crazy, how much information you can reliably read "between the lines" if you just collect enough data. For example check out this CCC-talk by David Kriesel - in which he demonstrates how much you can figure out just from some limited, publicly available data on a news website: https://media.ccc.de/v/33c3-7912-spiegelmining_reverse_engineering_von_spiegel-online https://media.ccc.de/v/33c3-7912-spiegelmining_reverse_engin... Being able to track mouse movements and hover interactions and scroll position and time spent and other activity on the page, gives you a ton more data to mine that way than when just registering page loads.
  - dgellow 6y ago
    But... how do you do this from CSS? Do you mean that you would add a :hover on a bunch of elements to gather multiple requests and the approximated position of the mouse?
    - hooby 6y ago
      For most behavioural profiling stuff it should be sufficient to just know which page element the mouse was over, no pixel-precise x/y coordinates needed. But if a mouse enters element A at time x, then enters element B at time x+n, and then enters element C at time x+m (and so on) - you can extrapolate the path the mouse most likely must have taken - and at which speed and acceleration - to be able to get to all these positions at those time points. It's just an approximation of course, but can be surprisingly accurate.
LinuxBender 6y ago
FWIW, there are browser addons to disable animations and transitions in CSS.

by hooby 6y ago

dgellow 6y ago

What personal information do you get that would be different from the HTTP requests sent by the browser to load the page in the first place?

hooby 6y ago
It's absolutely crazy, how much information you can reliably read "between the lines" if you just collect enough data. For example check out this CCC-talk by David Kriesel - in which he demonstrates how much you can figure out just from some limited, publicly available data on a news website: https://media.ccc.de/v/33c3-7912-spiegelmining_reverse_engineering_von_spiegel-online https://media.ccc.de/v/33c3-7912-spiegelmining_reverse_engin... Being able to track mouse movements and hover interactions and scroll position and time spent and other activity on the page, gives you a ton more data to mine that way than when just registering page loads.
- dgellow 6y ago
  But... how do you do this from CSS? Do you mean that you would add a :hover on a bunch of elements to gather multiple requests and the approximated position of the mouse?
  - hooby 6y ago
    For most behavioural profiling stuff it should be sufficient to just know which page element the mouse was over, no pixel-precise x/y coordinates needed. But if a mouse enters element A at time x, then enters element B at time x+n, and then enters element C at time x+m (and so on) - you can extrapolate the path the mouse most likely must have taken - and at which speed and acceleration - to be able to get to all these positions at those time points. It's just an approximation of course, but can be surprisingly accurate.

LinuxBender 6y ago

FWIW, there are browser addons to disable animations and transitions in CSS.