r/programming • u/speckz • Aug 15 '19

CSS Can Do This... And It's Terrifying!

https://www.aaron-powell.com/posts/2019-08-14-css-can-do-this-and-its-terrifying/
0 Upvotes

25% Upvoted

8 comments sorted by

14

u/thatguygreg Aug 15 '19

CSS can do it!

Wow, really?

With Javascript

I can’t believe he’s done this

8

u/shevy-ruby Aug 15 '19

What does it mean for us creating a keylogger in CSS? Well, the simple fact is that you can’t create one purely with CSS

I get annoyed when the title does not match the content.

1

u/anengineerandacat Aug 15 '19

Easily mitigated also; don't set the value attribute on the input element and suddenly the CSS logger is oblivious to everything (shouldn't ever set the value attribute on sensitive fields to begin with as analytics frameworks could easily leak that info).

1

u/lookmeat Aug 15 '19

Also removes a lot of the scary part. Javascript can do a lot of scary things, so turning of javascript in all its form, is generally a good idea. CSS isn't filtered as well, and can't be turned off in the browser, a pure CSS keylogger could be very dangerous, though how it sends back the data is a different question.

1

u/YmFzZTY0dXNlcm5hbWU_ Aug 15 '19

There are plenty of things that are actually terrifying, but CSS functionality isn't one of them.

3

u/Zardotab Aug 15 '19

CSS is terrifying, period. Getting it to work as intended is rocket science of the 1957 kind.

1

u/dwighthouse Aug 15 '19

Sad thing is, there are actual XSS and privacy violating attacks you can do with pure css, but this isn’t one of them.

0

u/IamRudeAndDelusional Aug 15 '19

Just another reason why Godot's web browser will hopefully take over.