Hacker News Reader

Comment by jwcrux | Hacker News Reader

That's the thing, though. I didn't try it, but my guess would be that even if they patch the CSS issue, I believe it would still be possible to set the visibility to hidden (notice they never set the visibility :), and use absolute positioning to set the new content on top of the old.

Also, I saw some different results as to where the content is injected. In some cases, it was right in the middle of my content - which seemed weird. Obviously, if they aren't consistently making sure their's has the last say, then it becomes easy to override their settings.

Of course - my CSS skills are awful, so someone please feel free to correct me on that.

View on HN

I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker.

It'll probably take them a while to catch everything. They could easily kill any CSS that's hitting the #rapportive ID with regex, or by making the ID a unique random string on each email. I believe placing all the original content in a "position:relative; overflow: hidden;" would fix your overlay concerns. Definitely an annoying cat-and-mouse game, but since they're ultimately writing the email that ends up in your inbox, they should be able to consistently prevent this kind of attack.

The main problem is that it's a cat and mouse game that really should not be happening in people's email. Saying, "hey, it's no big deal that we're clumsily wanking with your email contents/security because we'll easily be able to fix any problems that arise" is less comforting than simply not clumsily wanking with your email contents/security in the first place.

Replace "HTML/CSS injection" with the word spam and reread it again.

If things were true, spam would have died out by now. Admittedly, companies like Gmail do a good job of controlling but sufficiently large volumes of spam get through to the point where it's being opened and clicked where spammers still consider this a viable business.

So not, it's not a cat-and-mouse game where the owner wins. A sufficiently determined attacker will still get in. If your thesis were true, we would have built an unhackable computer by now.

If you've got access to the HTML, then you will be able to override any statement in CSS.

Without access to the HTML, you have the chance to get ridiculously specific, eg:

* html body div#rapportive...

Reply on news.ycombinator.com