5 ms·
Some harmless, old-fashioned fun with CSS
- comex 13y agoThis is very cute, but I think the CAPTCHA attack it cites is more interesting: a CAPTCHA can be inserted just about anywhere without raising undue alarm, CSS allows the text to be warped almost (if not exactly, with CSS shaders) like a real, image-based, CAPTCHA, and the user directly types back what was seen rather than the site having to guess based on performance on an asteroids game.
- ygra 13y agoEven if text is not warped I doubt users are concerned. Some CAPTCHAs are better than others, some warp the text more than others, so unwarped letters not necessarily stand out.
- jenius 13y agoWait, how is he doing this? Wish there was a tiny bit more explanation in the post...
- gmurphy 13y agoCSS lets you color links based on whether the user has visited them or not. Most of the Asteroids in the game are links - they use those same CSS rules to color themselves based on whether you've visited them or not. Script on the page can't tell what color the asteroids are, but it can tell what asteroids you've clicked on. By making the visited-link color the same as the background color of the webpage, we get the user to give away the color of the links, because they'd only be clicking on the links that they can see - the ones with a color different to the background.
- jandy 13y agoThank you, that was a much clearer explanation of what was happening. Also explains why I'd occasionally see a black circle drift over one of the colored ones.
- chm 13y agoThanks, that was a clearer explanation than his. Nifty. Btw, why do they want to do this?
- seanlinehan 13y agoImagine you had a brilliant idea to start a company which served demographically targeted advertisements to users across the web. Since you are brand-spanking-new you have very little data about users. You need to find a way to quickly and cheaply build demographic data about users so you can actually accomplish your mission. If you launch a ton of these types of games, you could build a pretty decent database of user's browsing histories. If you are using news sites as your sites of interest, you could use that browsing history to build up demographic data about each of the people who play your game (demographics for large sites like CNN are pretty well known). There are certainly other reasons, but this is the first one that came to mind.
- bigiain 13y agoReal life example - back when the CSS history snooping trick still worked, a travel site I worked on used to offer additional discounts to people who'd visited competitor sites that we knew were beating our regular pricing.
- hashmymustache 13y agohe's tossing a bunch of link elements that are 0x0 px with an 8px border at your ship for you to click on. Only ones with addresses you've visited are visible: a:visited { background-color:pink;} Because you're clicking the border and not the element which is 0x0 you're not redirected but he knows the mouse position and from there can figure out which link you clicked on.
- kenbellows 13y agoTo get picky, it's actually border-color:pink;
- hashmymustache 13y agooops, right on!
- sbierwagen 13y agohttp://i.imgur.com/2fhLhPF.png http://i.imgur.com/2fhLhPF.png That's cute.
- DuskStar 13y agoI got the same, and I'm relatively sure I've visited Facebook and Twitter at least once...
- Samuel_Michon 13y agoThen perhaps you didn’t shoot all the asteroids?
- tlarkworthy 13y agoyeah it said I did not visit http://www.facebook.com/home.php http://www.facebook.com/home.php when I have and I shot all asteroids.
- zeckalpha 13y agohttps?
- zachlatta 13y agoI got http://i.imgur.com/SVweWee.png http://i.imgur.com/SVweWee.png
- mattdw 13y ago"Sorry, this game works only in Firefox and Chrome." Welcome back to 1998. For the record, it works fine in Safari too. Why do people even do this?
- kevingadd 13y agoModern Safari is impossible to test against without buying a Mac ever since Apple stopped releasing current nightlies. (Running Safari6 in a VM isn't adequate since it disables webgl and changes some other behaviors)
- mistercow 13y agoThat is false. There are plenty of inexpensive services that let you use an in-browser remote desktop client to test against many different web browsers, including Safari.
- kevingadd 13y agoI just told you why those don't work. They don't have a real GPU so WebGL and other features don't work or don't behave like a real mac. Try it yourself against a website that uses modern HTML5 features. Same goes for audio.
- mistercow 13y agoBut this doesn't use WebGL or audio, and in fact runs perfectly well in a VM, so what exactly is your point? Also, "modern HTML5 features" covers plenty of things that work well without a GPU. It is only a tiny set of features that do not work. For the vast majority of modern sites, testing via a VM works just fine.
- Someone 13y agoIf it hasn't been tested in Safari, they should not state that it does not work in Safari. A better message would be "We have only tested this in Chrome and Friefox on Windows, so this application might not work for you." It is a bit like the difference between "File X does not exist", and "Could not find a file named X". Computer programs should be polite to the limit of serfdom, or they will come over as arrogant.
- GhotiFish 13y agoRead that paper linked by the article. Those attacks look so fun! I like the LCD attack in particular.
- chewxy 13y agoIt tells me I need a higher resolution screen. Bummer. Guess my tiny bedside netbook is safe then
- nijk 13y agoI hope this demo doesn't send any data back to a server, or else, Hello FBI.