Re:This site was styled by YouTube comments
by peaslock on Thursday February 09, 2023 @12:29PM
(#34727609)
Maybe not a good idea to link a page that runs source code created by random people. Well CSS is very safe, but still.
[ Parent
| on HN ]
Re:This site was styled by YouTube comments
by ompaLompa on Thursday February 09, 2023 @12:36PM
(#34727772)
You can do quite a bit of tracking with CSS by conditionally loading third party resources. Tracking pixels, loading different images on hover, active, focus, etc can effectively track users
For example some controlled frameworks can even have CSS only keylogging https://css-tricks.com/css-keylogger/
The correct solution is enable a strict Content Security Policy (CSP) - so even when a user compromises your website with XSS/CSS they cannot extract any data they obtain. Note: this website has not configured a Content Security Policy :(