Hacker News Reader

Comment by shakna | Hacker News Reader

CSS media queries don't get handled by anything that has the capability to send that information back, so window size reporting isn't needed for that.

The only place that needs it, are those JS apps that manually position items.

Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all those problems might evaporate or become extremely difficult to successfully use.

[0] https://www.quirksmode.org/dom/w3c_cssom.html

View on HN

CSS media queries themselves don't have the capability to send any tracking information back, but the effects they cause absolutely do. Consider:

  @media (min-width: 600px) { .pixel { background-image: url("/pixel?width=600"); } }
  @media (min-width: 700px) { .pixel { background-image: url("/pixel?width=700"); } }

You could add as many of these media queries as you like to increase the resolution of your tracking. Combine this with the min-height media query and you can get the absolute size of the view port.

That's still more finite than what JS can report, and can be easily broken by browser prefetching. (And could have performance implications that could drive users away.)

Whilst it's better-than-nothing fingerprinting, it is still far less effective than JS having access to the window and height properties directly.

False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs.

[1] https://github.com/jbtronics/CrookedStyleSheets

[2] https://github.com/maxchehab/CSS-Keylogging

Both those methods rely on the browser not prefetching certain resources, which they are absolutely allowed to prefetch.

So if a browser changes the prefetching algo, the method is immediately broken. (For example enabling network.predictor.enable-prefetch in Firefox).

It isn't an inherent weakness of CSS itself.

Reply on news.ycombinator.com