Crooked Style Sheeding – Webpage tracking using only CSS
If you're concerned as a user of a malicious site:<p>* Link click tracking - So what, the site could route you through a server side proxy anyways<p>* Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix<p>* Media query - So what, user agent gives this away mostly anyways<p>* Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most)<p>If you're concerned as a site owner that allows third party CSS:<p>* You should have stopped allowing this a long time ago (good on you, Reddit [0] though things like this weren't one of the stated reasons)<p>* You have your Content-Security-Policy header set anyways, right?<p>Really though, is there an extension that has a checkbox that says "no interactive CSS URLs"? I might make one, though still figuring out how I might detect/squash such a thing. EDIT: I figure just blocking url() for content and @font-face.src would be a good compromise not to break all sorts of background images for now.<p>0 - <a href="https://www.reddit.com/r/modnews/comments/66q4is/the_web_redesign_css_and_mod_tools/" rel="nofollow">https://www.reddit.com/r/modnews/comments/66q4is/the_web_red...</a>