Hacker News Reader

Comment by TomGullen | Hacker News Reader

What extra data can you track using this method over just normal HTTP logging?

The only things I can think of are how a user interacts with a page - I don't particularly think this is too concerning - although as with all these things there are possibly much more creative uses of it that I haven't considered.

There's a new image property loading="lazy" which generally will load an image when it approaches the viewport. This could also be "abused" in similar ways.

If this does turn out to be a privacy concern, browser settings/privacy addons could simply load all lazy images or images refered to in CSS/JS files on load which would nullify this technique.

View on HN

You can mostly track the interactions. Just the fact that CSS was loaded distinguishes the user from a lot of automated tracking. You should be able to track time spent on the page with CSS animations as well, up to a point, that's mentioned in the post.

I don't think you can do anything particularly nasty even with CSS variable programming which can apparently be used for interactive games (https://github.com/propjockey/css-sweeper). As I looked into things writing for this post I couldn't come up with a non-JS way to transition much significant data into CSS.

HTTP logging can give a pretty strong indicator of time spent on pages (not perfect, but good with large volumes) as well as navigated routes through the site already.

It would seem to me that the only advantage of this technique is to track mouse movements on the page in a very low resolution, and likely labour intensive way. Low resolution because it only works the first time on each page load, and is going to be tricky to get any meaningful granularity on the data.

I am not particularly concerned about this but my privacy concerns are definitely lower than the general consensus of this site. I only compare to HTTP logging as this is the most hidden/covert way of tracking users.

I used this (via :hover) to play with mouse movement tracking. The resolution was significantly worse than the JS approach. But it worked, and even allowed to use some ML analysis on mouse movement patterns. That was about 10 years ago, so I no longer have the code/site.

Another trick is to use JavaScript to check if images have a size. Most bots don't download those assets to save bandwith.

There are probably quite a few fingerprinting surfaces you could pull out of CSS. For example (these are educated guesses):

* Track what fonts a user has installed by asking for preinstalled fonts and using loaded fonts as a fallback

* Track screen width and height by conditionally loading an image

* Track screen height vs window height (linked to OS and various user settings)

Firefox won't do lazy loading if JS is disabled, because it doesn't want lazy loading to work as a fallback page depth tracker. If JS is enabled, all bets are off, so there's not much point in using lazy loading instead of just polling/intersection observer.

Generally yes, if you stick just to CSS you can log HTTP request initiated by user's interaction or user's environment. To name some environmental: locally installed fonts, viewport dimensions, colour depth, resolution etc. Interaction is anything pointer position related, focus management, and to some degree you can do simple kind of "keylogging" or text character presence detection.

https://github.com/jbtronics/CrookedStyleSheets https://news.ycombinator.com/item?id=16157773

Almost nobody turns off JavaScript because it breaks the whole web. You can't even view YouTube.

This is less interesting than existing JavaScript techniques to identify or filter out crawlers. It works, when the image is not cached, but it's fundamentally inferior to anything you can do with JavaScript, and if you don't have JavaScript at all, I don't see why you would want to care. Just lump that little bit of traffic in with the bots for analytics purposes.

I use NoScript and only turn on Javascript if I have to. It happens less often than you think. Most sites will load enough for you to read them without JS.

You can use CSS to identify fonts and feature detection like Modernizr to uniquely identify browsers and users. Track clicks, mouse over, language, screen size, time spent can be calculated with animations, pretty much anything you would do with javascript except canvas fingerprinting.

The big advantage of this is that you can still track and uniquely identify people even if they turn off cookies and javascript.

> The only things I can think of are how a user interacts with a page - I don't particularly think this is too concerning

Except that many people don't want others to know how much they read something... I don't care, but many believe that is private.

> If this does turn out to be a privacy concern, browser settings/privacy addons could simply load all lazy images or images refered to in CSS/JS files on load which would nullify this technique.

So you load more invisible pixel and make this even more effective as now you'll be able to get much more granular data, like the scroll position!

By “normal HTTP logging” what do you mean exactly? Most logging is done with JavaScript, and this is JS-free, would even work in an environment with JS disabled.

HTTP logging is what an HTTP server does. It doesn't require JavaScript. Fetching a resource with "HTTP Access Logs" enabled on a server will indicate the what and who, if configured properly. The logs typically end up in a file on the server's filesystem.

Thanks for clarifying — but this doesn’t seem particularly useful for many types of tracking. Measuring things like bounces, scroll depth, engagement on modules, etc, require logging post-load.

You can disable lazy loading images in about:config in Firefox

Reply on news.ycombinator.com