Hacker News Reader

Comment by autoexec | Hacker News Reader

I already keep SVG disabled for security reasons, but it's increasingly looking like I'll have to find some way to disable CSS too. It's too bad people couldn't leave CSS alone as a nice simple (sort of) way to format text because turning it into another programing langue is begging for it to be abused by hackers and other malicious actors (like advertisers) just like JS

View on HN

> It's too bad people couldn't leave CSS alone as a nice simple (sort of) way to format text

The base form of this attack goes back to the original CSS 1.

Honestly you are massively overreacting. This type of attack was much much easier to pull off in the late 2000s then it is now. Its basically impossible in practise now a days.

Maybe I’m a too much of a normie to understand, but surely keeping your secure data away from your browser must be better than securing the browser to the point that it stops working?

Any service that is exposed as a website that has data which you would like to keep secure = potentially hacked through attacks like these. It's usually not possible to choose to not have data available on internet connected services sadly.

Of course, by why not access those particular services in a more secure way? With other browser settings, another browser, or another machine altogether?

Turning off JS permanently is like keeping your wallet in a safe you carry around all the time because once in a while you need to visit the dangerous parts of the town.

I have JS off by default and click one button to turn it on per website. You might be surprised how much faster the web is and how often you don't need JS.

Yes, NoScript is great and I'm surprised how often HN users seem unfamiliar with the concept or need it justified to them.

use browsing containers to restrict access to specific contexts and this kind of thing basically can't happen

CSS isn't the security issue here. IFrames are the security issue; and have been since the first day they were added to a browser.

nah, that is overkill. the probability of falling for this is still tiny and it cannot break the sandbox, steal session cookies, or anything like that .

Sandbox escapes are discovered all the time (pretty sure I've read about a few just this past week) and there are a lot of other problems CSS can enable (ads, fingerprinting, etc)

What security reasons (other than that cited by this demo, which doesn't seem to work on most platforms)?

why not disable javascript once and for all.

Most site shouldn't run any js after content is loaded.

I hope there's something like <body onload="js.disable()">

I can only do it manually in DevTool.

I've got noscript which at least keeps JS off by default and allows me to selectively enable scripts by domain. Now I just a similar tool for CSS. Something that whitelists a sane set of features that can't be used (at least as easily) for interactivity, ads, fingerprinting, and other malicious activity while letting me explicitly blacklist annoyances (like scrollbar styles or sticky headers). The way things are going I'll probably need something similar for HTML too.

Does JS protect against this particular attack? It seems like it's mostly implemented in CSS and SVG.

That's not relavent to the attack discussed in the article. These types of attacks do not involve javascript, nor could they due to the same origin policy.

Why on earth would you want to load JS before content is loaded but not after? If you are able to assemble the page based on data sources before loading the page, you can just server-render the damn thing and disable JS altogether?

JS is essential for polished UX when you have highly interactive components. Technically mapquest got server-rendered interactive maps working, but no one would choose that over the usability of Google Maps or OpenStreetMaps today

> Why on earth would you want to load JS before content is loaded but not after?

apparently, single-page-apps is an unstoppable trend. I tried to disable JS and 99% site won't work.

But for content sites, after the article is loaded, disabling JS provides a much better reading experience.

> but no one would choose that over the usability of Google Maps or OpenStreetMaps today

That's a valid use for JS. But if you think about it, can we make a js free map tool using technics from OP's article? https://codepen.io/rebane2001/details/OPVQXMv

As a user: Browsers let you manually disable JS, but you can also use an extension such as NoScript (I do).

As a web developer: You can use Content Security Policy to limit or disable JS, as well as other resources such as CSS and images.

Reply on news.ycombinator.com