> Sure, but it's not easy. I have XHR disabled by default and can enable it with 2 clicks. > But disabling XHR/fetch/others won't stop your browser from being

> Sure, but it's not easy. I have XHR disabled by default and can enable it with 2 clicks. > But disabling XHR/fetch/others won't stop your browser from being able to make requests. > CSS can make requests Hence it being disabled. > HTML can also make requests (<img> and <iframe> elements comes to mind). Which is why I have those disabled by default too. > CSS cannot be used as an external API as much as HTML cannot be used as an API But it can be used as an API and because there are people out there, like yourself, who downplay this ability, there are those who will leave it running… > assumes that JS is activated, otherwise you can't really do anything dynamic with the data …and hence, may have disabled the usual routes that you listed - XHR, images, frames etc - and leave JS on for some other reason while believing they've mitigated a number of major threats. It's hard to produce perfect security or anti-tracking behaviour, very hard, but that doesn't mean we should ignore CSS.