CSS is so Overpowered it can Deanonymize Facebook Users

[DooKey]

CSS or Cascading Style Sheets have become so powerful that it can be abused to deanonymize Facebook users. CSS can even be used to link IP addresses and profiles to real-life people. This tool is fast becoming a real threat to internet privacy. However, Facebook isn't the only site that can be exploited because any site that allows content to be put on other webpages in iframes is vulnerable. At least Chrome and Firefox have fixed this issue so far. Once again this should make it plain to users of the internet that privacy is a fragile thing and you should refrain from voluntarily giving up your personal information on social media.

In research published today, Ruslan Habalov, a security engineer at Google in Switzerland, together with security researcher Dario Weißer, have revealed how an attacker could abuse CSS3 mix-blend-mode to leak information from other sites.

 

[BSmith]

Better yet, just give a big, fat, finger to social media. You'll feel better once you reclaim the real world. It may not solve all your security issues, but it would be a start.

Says the guy typing in a public forum.....hehe.

 

[greenman]

Iframes? What is this.. the 90s? And how exactly does facebook use iframes?

It's true about CSS tho. It used to be that you made sites with some sort of structure. Now a days you just have a bunch of divs and a ton of CSS to manipulate them insanely.

 

[seanreisk]

I had a lot of hope that the 10+ years they spent on CSS3 would result in a simple but powerful set of building blocks that would help people to predictably layout a web page. Instead we got a huge pile of dogshit. Getting a predictable layout with CSS3 alignment and positioning makes my teeth itch, but now that their rules are out in the wild all future browsers will have to inherit them, or else Grandma's page of cat .gifs won't render.

 

[velusip]

I had a lot of hope that the 10+ years they spent on CSS3 would result in a simple but powerful set of building blocks that would help people to predictably layout a web page. Instead we got a huge pile of dogshit. Getting a predictable layout with CSS3 alignment and positioning makes my teeth itch, but now that their rules are out in the wild all future browsers will have to inherit them, or else Grandma's page of cat .gifs won't render.

The funny thing is, Microsoft fixed css layouts with display:grid in ie10. It has become the foundational standard for css layouts in all browsers since very early 2017 and flex is now based on it too. Layout is fixed. Seriously. I know, it's weird.

The only real wants for css are now variables and maybe removal of forced page break rules for some complex styles (like columnar). Unforunately, with the increased acceptance of intermediate transpilers to solve problems like the former, and the complete lack of will to improve readability and typographic aesthetic, we might not see a push to solve the second either.

 

[seanreisk]

The funny thing is, Microsoft fixed css layouts with display:grid in ie10.

I don't mind MS's grid, but it feels like a simplified table layout and it doesn't allow the cells of the table to move around like a div can. It's good for 90% of what we do. But I wanted CSS3 to be so much more, the simple things like alignment, justification, font-size compared to page size, fixed div sizing, media queries, etc. should all have been nailed down. The flow shit is ... shit, and they needed a much better model for responsive web pages.

The web is the single-most important window into the internet, and I still have three computers and dumbed-down pages just to be sure everything renders properly.

 

[Dick Johnson]

Iframes? What is this.. the 90s? And how exactly does facebook use iframes?

It's not Facebook, it's actually a browser problem:

"The technique relies on luring users to a malicious site where the attacker embeds iframes to other sites. In their example, the two embedded iframes for Facebook's social widgets, but other sites are also susceptible to this issue.

The attack consists of overlaying a huge stack of DIV layers with different blend modes on top of the iframe. Depending on the time needed to render the entire stack of DIVs, an attacker can determine the color of that pixel shown on the user's screen. The researchers say that by gradually moving this DIV "scan" stack across the iframe, it is possible to determine the iframe’s content."

 

[dgz]

Iframes? What is this.. the 90s? And how exactly does facebook use iframes?

It's true about CSS tho. It used to be that you made sites with some sort of structure. Now a days you just have a bunch of divs and a ton of CSS to manipulate them insanely.

You're thinking frames. Every time you see an embedded player, it's in iframe. It's the best way to watch youtube, actually. No age verification or anything.

 

[greenman]

You're thinking frames. Every time you see an embedded player, it's in iframe. It's the best way to watch youtube, actually. No age verification or anything.

Ah, I did not realize HTML5 still uses iframes for media embeds.. It's never been a good or secure solution, I was under impression that it was abandoned..

 

[haz_mat]

... can be exploited because any site that allows content to be put on other webpages in iframes is vulnerable. ...

That statement makes me cringe. Out of all the tricks I've learned over the past couple of years, iframes add a stupid amount of unnecessary complexity. I cannot imagine a situation where an iframe would be a better solution than using an API and some javascript (but of course you cant always control where you source your data).

I had a lot of hope that the 10+ years they spent on CSS3 would result in a simple but powerful set of building blocks that would help people to predictably layout a web page. Instead we got a huge pile of dogshit. Getting a predictable layout with CSS3 alignment and positioning makes my teeth itch, but now that their rules are out in the wild all future browsers will have to inherit them, or else Grandma's page of cat .gifs won't render.

In my experience, there is little value in writing your own CSS these days (unless its something trivial or academic). You're either using a JS based front-end or hand coding your own bootstrap elements - which present their own challenges of course, but you can at least take a step back from the CSS and focus more on the appearance.

The overall web platform environment could use a massive overhaul, but it wont happen quick because of the entrenched monstrosities that are built on the old tools. 15 years ago, I don't think anyone foresaw javascript would become the backbone of dynamic web pages.

 

[dgz]

Ah, I did not realize HTML5 still uses iframes for media embeds.. It's never been a good or secure solution, I was under impression that it was abandoned..

No, no. There hasn't been a need for "media embed" for a long time. It's just that iframes allow you to load another HTML page into your current document. How would you do it if you were youtube?

 

[dgz]

Iframes? What is this.. the 90s? And how exactly does facebook use iframes?

It's true about CSS tho. It used to be that you made sites with some sort of structure. Now a days you just have a bunch of divs and a ton of CSS to manipulate them insanely.

Well, at some point you reach maximum div manipulation and go WebGL. The more stuff you have going on the screen, the more sense it makes. Provided there's a gpu, of course.

 

[velusip]

I don't mind MS's grid, but it feels like a simplified table layout and it doesn't allow the cells of the table to move around like a div can. It's good for 90% of what we do. But I wanted CSS3 to be so much more, the simple things like alignment, justification, font-size compared to page size, fixed div sizing, media queries, etc. should all have been nailed down. The flow shit is ... shit, and they needed a much better model for responsive web pages.

The web is the single-most important window into the internet, and I still have three computers and dumbed-down pages just to be sure everything renders properly.

Grids cascade like everything else, and can be independently overlayed. e.g. put grids inside tweening divs, or span a div over optional screens within a grid. It is a simplified table layout, but without any of the rigidity.

Units like fr, vw, vh, etc are based on screen and subsequently pt and pc and all alignment forms in all modes works within grid-areas. It's difficult to break out of the habits of years of hacks and workarounds, but as of 2017 March I really have no complaints. Media queries are a bit out of scope, but they do work in realtime. We might see improvements in the near future along with variables and more queries -- certainly with their own slew of browser vulnerabilities.