11 ms·

I have no idea how naive this question is... but here goes. Some privacy-conscious users disable JS, or use NoScript to selectively enable JS. My understanding

I have no idea how naive this question is... but here goes. Some privacy-conscious users disable JS, or use NoScript to selectively enable JS. My understanding is that this is (1) because JS engines are often themselves a source of vulnerabilities, (2) untrusted code execution might be risky in the face of speculation execution/access attacks. Do such users need to worry about either, or both, with such advanced, compute-y CSS primitives?

lelandfe 2y ago
Well, exfiltration via CSS is possible already: https://infosecwriteups.com/exfiltration-via-css-injection-4e999f63097d https://infosecwriteups.com/exfiltration-via-css-injection-4... I don't see these new CSS features opening up privacy issues, though.
creata 2y ago
Imo, those are security reasons to disable JS. The main privacy reason (again, imo) to disable JS is simply that JS can just send each and every one of your inputs to the server. But as lelandfe points out, CSS can do that, too, for form and mouse/touch inputs at least. So the main difference is that JS tracking is ubiquitous, and CSS tracking is very rare afaik. (This isn't a response to the question about whether speculative execution attacks are possible, sorry.)
brigandish 2y ago
I've disabled CSS too (via uBlock), it's amazing how many sites break because of it (less than the reliance on JS though). Still, the experience is generally still better enough times that I've left it as the default.
chefandy 2y ago
It depends on the use case. JS makes browser fingerprinting a lot more accurate. If you're using a VPN, I believe JS can leak your real IP, but I'm not positive about that. There's also a big chunk of zero-day attack surface that's gone. Obviously they can't do in-browser bidding scripts for ad space or whatever. Personally I always keep it on, but for some use cases or levels of privacy paranoia, it makes sense.

lelandfe 2y ago

Well, exfiltration via CSS is possible already: https://infosecwriteups.com/exfiltration-via-css-injection-4e999f63097d https://infosecwriteups.com/exfiltration-via-css-injection-4... I don't see these new CSS features opening up privacy issues, though.

creata 2y ago

Imo, those are security reasons to disable JS. The main privacy reason (again, imo) to disable JS is simply that JS can just send each and every one of your inputs to the server. But as lelandfe points out, CSS can do that, too, for form and mouse/touch inputs at least. So the main difference is that JS tracking is ubiquitous, and CSS tracking is very rare afaik. (This isn't a response to the question about whether speculative execution attacks are possible, sorry.)

brigandish 2y ago

I've disabled CSS too (via uBlock), it's amazing how many sites break because of it (less than the reliance on JS though). Still, the experience is generally still better enough times that I've left it as the default.

chefandy 2y ago

It depends on the use case. JS makes browser fingerprinting a lot more accurate. If you're using a VPN, I believe JS can leak your real IP, but I'm not positive about that. There's also a big chunk of zero-day attack surface that's gone. Obviously they can't do in-browser bidding scripts for ad space or whatever. Personally I always keep it on, but for some use cases or levels of privacy paranoia, it makes sense.