Crooked Style Sheeding – Webpage tracking using only CSS
If you're concerned as a user of a malicious site:* Link click tracking - So what, the site could route you through a server side proxy anyways* Hover tracking - Can track movements of course, but doesn't really help fingerprinting. This is still annoying though and not an easy fix* Media query - So what, user agent gives this away mostly anyways* Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most)If you're concerned as a site owner that allows third party CSS:* You should have stopped allowing this a long time ago (good on you, Reddit [0] though things like this weren't one of the stated reasons)* You have your Content-Security-Policy header set anyways, right?Really though, is there an extension that has a checkbox that says "no interactive CSS URLs"? I might make one, though still figuring out how I might detect/squash such a thing. EDIT: I figure just blocking url() for content and @font-face.src would be a good compromise not to break all sorts of background images for now.0 - https://www.reddit.com/r/modnews/comments/66q4is/the_web_red...