CSS tracking

❗This article is a stub. You can help by expanding it.

A moderator needs to check the page before this notice can be removed. Visit the noticeboard or the #appeals channel in either Zulip or Discord to request removal.

More info ▼

An article may be flagged as a stub when it is missing major elements needed to make it useful to a reader. You can help by adding missing sections, verifiable sources, relevant company policies and communications, etc. to make the article more complete.

⚠️This article's relevance is under review. It does not appear to be in-scope for the wiki.

A moderator needs to check for consensus on relevancy before this notice can be removed. Visit the noticeboard or the #appeals channel in either Zulip or Discord to request removal. Discussions of this article's relevancy should take place on its talk page.

More info ▼

You can help establish relevance by showing how the issue represents either large-scale consumer exploitation (systemic practices, recurring incidents, etc.) or a case of 'modern' consumer rights issues such as privacy violations, barriers to repair, or ownership rights, in line with the Mission statement and Moderator Guidelines.

CSS-based tracking and CSS fingerprinting consist of abusing the semantics of CSS, a styling language used to present virtually all web-pages, in order to trick web-browsers to send data to servers.

How it works

CSS can declare that certain resources/assets be used if certain conditions are met.^[1] Since browsers implement lazy-loading, this means that assets will only be requested when the conditions are met. This effectively allows pinging arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"server" to gather more data about user behavior.^[2]^[3]

Traditionally, CSS tracking was (and still is) implemented as a limited finger-printer, typically by enumerating installed fonts and checking window dimensions.^{[citation needed]}

Either way, the attack has limitations, as caching avoids (no guarantee) repeated requests from happening.

Why it is a problem

Though CSS is widely believed to be "just a declarative styling system" with no practical compute power, it is actually a virtually Turing-complete programming language,^[4]^[5] a fact which may leave even the most privacy-minded users vulnerable to tracking.^{[citation needed]} This mode of attack breaks the common belief that HTML and CSS can only be used to make static/passive documents, whilst JavaScript represents the real "threat" to be countered through disabling.^{[citation needed]}

Examples

Some examples of CSS tracking include:

*
*
*

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

References

[1] ttps://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Media_queries

[2] ttps://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense

[3] ttps://portswigger.net/research/inline-style-exfiltration

[4] ttps://lyra.horse/x86css/

[5] ttps://lyra.horse/css-clicker/

[1]

[2]

[3]

[4]

[5]