Re:Crooked Style Sheeding – Webpage tracking using only CSS
by avian on Tuesday January 16, 2018 @08:25AM
(#16157957)
A more interesting question would be if it is possible to disable the "dynamic" part of the CSS in any browser. Things like ":hover", ":active" that this proof of concept abuses and leave just the more benign static styling rules.
[ Parent
| on HN ]
Re:Crooked Style Sheeding – Webpage tracking using only CSS
by Tepix on Tuesday January 16, 2018 @09:50AM
(#16158531)
Perhaps preventing the loading of URLs in the dynamic parts would be enough?
Re:Crooked Style Sheeding – Webpage tracking using only CSS
by Klathmon on Tuesday January 16, 2018 @09:57AM
(#16158593)
Probably not, you'd also need to disable a lot of other optimizations.
For example, a browser will not load an image if it's set to `display: none` in CSS (at least not right away). That could be abused to then trigger the download when CSS changes without a URL needing to be on the CSS at any point.