[{"data":1,"prerenderedAt":656},["ShallowReactive",2],{"project-16422696":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":45,"post_text":48,"what":49,"said":67,"maker_in_thread":155,"shape":166,"grid":170,"attempts":617,"same_week":618,"maker_shows":43,"maker_hidden":648,"reader_version":649,"card":650},"16422696","CSS-Keylogging","A CSS Keylogger","title","Show HN: A CSS Keylogger","https:\u002F\u002Fgithub.com\u002Fmaxchehab\u002FCSS-Keylogging","github.com","maxchehab",1519151876,2018,576,168,24,2155,2,"legend","security_privacy","security proof of concept","browser_extension",[24,25,26,27],"css keylogger","css exfiltration","password security","attribute selector","curious",-0.146,{"positive":31,"neutral":32,"mixed":33,"critical":34},6,75,0,21,102,{"idea":37,"execution":39,"privacy":40,"performance":42,"docs":44},{"positive":38,"critical":18},5,{"positive":33,"critical":38},{"positive":33,"critical":41},12,{"positive":33,"critical":43},1,{"positive":33,"critical":43},[43,18,46,46,46,18,18,46,46,46,46,46,46,43,46,33,33,33,43,43,33,33,46,18,18,43,18,46,46,18,46,18,47,46,47,46,43,33,46,46],3,4,null,{"problem":50,"audience":48,"pricing":48,"motivation":48,"time_to_build":48,"stack":65,"openness":66,"stage":66,"team_size":66},{"value":51,"source":52,"evidence":53},"CSS attribute selectors can expose input values to a remote server, leaking typed characters.","commenter",[54,58,62],{"id":55,"by":56,"text":57},"16422834","rickdmer","Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this…",{"id":59,"by":60,"text":61},"16423226","dmitrygr","No, since it matches only the last character, you watch the requests it makes IN order to get the entire password. As you type \"qwerty\", it will request \"Q\", \"W\", \"E\", \"R\", \"T\",…",{"id":63,"by":11,"text":64},"16423188","Yes they can. This attack does not have to be carried done through a chrome extension. I simply chose that because it is the easiest to show off. This can be hidden inside of a…",[],"unknown",{"praise":68,"objections":80,"requests":118,"questions":134,"alternatives":140},[69],{"value":70,"source":52,"evidence":71},"Clever exploit, neat trick using the selector",[72,76],{"id":73,"by":74,"text":75},"16424906","xab9","Nice job. Css had similar attacks maybe a decade ago, with link:visited (referer snooping) and image with src to a logged in site... but I like the selector trick. Extensions are…",{"id":77,"by":78,"text":79},"16422825","jlg23","I have not tried it, but if it works (it should): Chapeau, a very neat exploit indeed.",[81,96,107],{"value":82,"source":52,"evidence":83},"Only works when the DOM value attribute is updated, e.g. by React, not on normal typing",[84,88,92],{"id":85,"by":86,"text":87},"16423277","AndrewStephens","This is neat but doesn't really work as an attack. The CSS selectors work on the value HtmlNode attribute rather than the Javascript \"value\" value, which aren't linked normally.…",{"id":89,"by":90,"text":91},"16424907","Manishearth","This is incorrect. The [value=foo] selector does not work for the actual value of the field, only the `value` attribute (used to set the initial value). This means that both: -…",{"id":93,"by":94,"text":95},"16423122","bfred_it","No it does not. CSS selectors do not apply to input content and `[value]` selectors apply to attributes, which are not updated by just typing in it. This is not a CSS keylogger…",{"value":97,"source":52,"evidence":98},"Real vulnerability lies in sites storing passwords in the DOM, not CSS itself",[99,103],{"id":100,"by":101,"text":102},"16423342","teilo","This has nothing to do with vulnerabilities in CSS or Javascript. It has to do with ill-conceived authentication implementations, written in Javascript, that save passwords in…",{"id":104,"by":105,"text":106},"16429132","twhb","This isn’t a problem. CSS could already control what’s displayed and what effect it has. It could already make clicking “next page” open an invisible chat to their account, your…",{"value":108,"source":52,"evidence":109},"CSP or disabling injected CSS would mitigate it",[110,114],{"id":111,"by":112,"text":113},"16423331","wuyishan","Couldn't Content Security Policy (CSP) [1] be used to mitigate this attack? [1]: https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FCSP",{"id":115,"by":116,"text":117},"16429061","yuchi","Or just use correctly defined CSP",[119],{"value":120,"source":52,"evidence":121},"Guidance on making React password fields uncontrolled",[122,126,130],{"id":123,"by":124,"text":125},"16423607","enobrev","This is speculative as I haven't tested out this vulnerability or attempted to avoid it (yet), but I imagine this means it would be a good idea to make password fields…",{"id":127,"by":128,"text":129},"16424981","Cyranix","I believe using `defaultValue` instead of `value` would be an appropriate remediation.",{"id":131,"by":132,"text":133},"16428304","oblosys","One option is to make the input component uncontrolled by removing the value={this.state.password} prop, but keeping the onChange handler to maintain the password in the state…",[135],{"value":136,"source":52,"evidence":137},"Does it work on normal typed input without attribute updates?",[138,139],{"id":55,"by":56,"text":57},{"id":93,"by":94,"text":95},[141,148],{"value":142,"source":52,"evidence":143},"CrookedStyleSheets webfont unicode-range keylogging",[144],{"id":145,"by":146,"text":147},"16427394","myfonj","To some limited degree (you can detect presence, not position or number of occurences of character), you can do CSS only 'keylogging' even for non-reactive (sans JavaScript)…",{"value":149,"source":52,"evidence":150},"CSS Exfil research by Mike Gualtieri",[151],{"id":152,"by":153,"text":154},"16423097","sachleen","You'd have to have all permutations of any length password in the css file AND it would have to be pre-filled using the value attribute. The original post on this talks about it…",{"comments":38,"answered":47,"key":156},[157,160,163],{"id":158,"text":159},"16423003","Author here. I believe the injection of the css in the chrome extension will only work in newer versions of chrome. However the \"attack\" would still work for all browsers. :)",{"id":161,"text":162},"16423345","Javascript can be blocked from chrome extensions. In fact, Instagram does block javascript. However, clearly css is not blocked.",{"id":164,"text":165},"16424104","It actually can't. Instagram does use this protect java-script injection from extensions, but clearly injecting CSS is allowed.",{"commenters":167,"max_depth":168,"maker_replies":38,"first_comment_mins":168,"lifespan_hours":169},110,11,146,[171,173,176,178,180,182,184,186,189,193,197,201,204,207,208,211,214,217,219,222,225,227,230,233,236,239,242,245,248,251,254,257,259,262,265,268,271,274,277,280,282,285,288,291,293,295,297,300,303,306,307,310,313,315,318,321,324,325,328,329,330,332,335,337,340,342,345,347,349,351,354,358,360,363,366,369,372,373,376,380,382,385,387,390,394,397,399,402,404,407,409,411,413,414,416,419,421,424,427,429,433,436,438,441,444,447,451,452,457,459,462,465,467,471,473,475,477,480,484,486,489,491,492,496,499,503,505,506,509,512,516,518,520,522,525,528,530,533,535,539,542,546,548,549,552,554,558,562,565,568,571,574,576,579,581,583,585,588,590,592,595,597,599,601,606,609,612,614],[145,33,46,172,146,33],"project\u002Fneutral\u002Fidea",[174,33,43,175,90,33],"16430612","project\u002Fcritical\u002Fexecution",[177,33,46,172,153,33],"16432733",[55,43,43,179,56,33],"project\u002Fcritical\u002Fprivacy",[158,43,33,181,11,43],"maker\u002Fneutral\u002Fnone",[73,43,38,183,74,33],"maker\u002Fpositive\u002Fidea",[89,43,43,185,90,33],"maker\u002Fcritical\u002Fexecution",[187,43,43,179,188,33],"16423020","akincisor",[190,43,46,191,192,33],"16423336","project\u002Fneutral\u002Fexecution","criswell",[194,43,46,195,196,33],"16425318","project\u002Fneutral\u002Fprivacy","Klathmon",[198,43,33,199,200,33],"16426386","commenter\u002Fneutral\u002Fnone","bzbarsky",[202,43,46,172,203,33],"16423118","dclowd9901",[205,43,46,191,206,33],"16423216","jaymzcampbell",[59,43,46,191,60,33],[209,43,46,191,210,33],"16423350","gsnedders",[212,43,46,191,213,33],"16423459","cag_ii",[215,43,33,199,216,33],"16423509","usrusr",[218,43,33,199,213,33],"16423756",[220,43,46,191,221,33],"16428043","gall0ws",[223,43,33,199,224,33],"16425476","ateesdalejr",[226,43,33,199,213,33],"16426005",[228,43,46,191,229,33],"16423569","regularhackerer",[231,43,43,179,232,33],"16423580","Francute",[234,43,33,199,235,33],"16424035","X-Istence",[237,43,46,195,238,33],"16425759","tmerse",[240,43,46,191,241,33],"16426965","netsharc",[243,43,46,191,244,33],"16427758","early",[246,43,43,179,247,33],"16423614","plopz",[249,43,46,195,250,33],"16424261","hinkley",[252,43,33,199,253,33],"16424574","brailsafe",[255,43,33,199,256,33],"16424651","eterm",[258,43,46,195,196,33],"16425388",[260,43,46,195,261,33],"16425946","roywiggins",[263,43,46,191,264,33],"16424449","ohmatt",[266,43,46,191,267,33],"16428123","spyder",[269,43,46,172,270,33],"16423155","theandrewbailey",[272,43,33,199,273,33],"16423180","kodablah",[275,43,46,195,276,33],"16426747","sgc",[278,43,46,172,279,33],"16423329","jakobegger",[281,43,46,172,270,33],"16423529",[283,43,46,172,284,33],"16424332","thefifthsetpin",[286,43,46,172,287,33],"16425339","dillondoyle",[289,43,46,172,290,33],"16423335","magnat",[292,43,33,199,74,33],"16424923",[294,43,46,191,132,33],"16423316",[296,43,46,191,192,33],"16423409",[298,43,46,191,299,33],"16423533","humblebee",[301,43,46,191,302,33],"16423534","vog",[304,43,46,191,305,33],"16424254","poxrud",[127,43,46,191,128,33],[308,43,33,199,309,33],"16426221","elliotec",[311,43,33,199,312,33],"16426376","NoInkling",[314,43,33,199,309,33],"16426624",[316,43,46,191,317,33],"16426131","dimgl",[319,43,43,175,320,33],"16427763","baddox",[322,43,43,175,323,33],"16428618","always_good",[123,43,46,191,124,33],[326,43,33,199,327,33],"16424182","Semiapies",[131,43,46,191,132,33],[115,43,46,195,116,33],[331,43,33,199,124,33],"16432449",[333,43,33,199,334,33],"16424575","djsumdog",[336,43,33,199,74,33],"16424876",[338,43,33,199,339,33],"16428197","endless1234",[341,43,33,199,74,33],"16468551",[343,43,33,199,344,33],"16425072","mrtksn",[346,43,33,199,320,33],"16426537",[348,43,33,199,344,33],"16427664",[350,43,33,199,320,33],"16427756",[352,43,33,199,353,33],"16428334","blablabla123",[355,43,33,356,357,33],"16426031","other\u002Fneutral\u002Fnone","arca_vorago",[359,43,33,199,309,33],"16426209",[361,43,33,356,362,33],"16426968","gear54rus",[364,43,33,356,365,33],"16430800","na85",[367,43,33,356,368,33],"16426415","phoenix616",[370,43,33,199,371,33],"16426659","kakarot",[100,18,43,179,101,33],[374,18,33,199,375,33],"16423456","blixt",[377,18,33,378,379,33],"16428539","commenter\u002Fneutral\u002Fprivacy","Buge",[85,46,43,381,86,33],"project\u002Fcritical\u002Fidea",[383,46,33,199,384,33],"16423312","slig",[386,46,33,199,86,33],"16423362",[388,46,33,199,389,33],"16423802","bfrydl",[391,46,33,392,393,33],"16424074","commenter\u002Fneutral\u002Fdocs","benatkin",[395,46,33,199,396,33],"16426405","acostanza",[398,46,33,199,320,33],"16426592",[400,46,33,199,401,33],"16427543","rav",[403,46,33,199,320,33],"16427747",[405,46,33,199,406,33],"16428763","insin",[408,46,33,199,320,33],"16428941",[410,46,33,392,393,33],"16435029",[412,46,33,199,320,33],"16426548",[161,46,33,195,11,43],[415,46,46,181,94,33],"16423383",[417,46,46,418,74,33],"16424968","maker\u002Fneutral\u002Fprivacy",[420,46,33,199,299,33],"16423359",[422,46,46,195,423,33],"16423594","moojd",[425,46,43,179,426,33],"16426243","fareesh",[428,46,43,179,229,33],"16423688",[430,46,38,431,432,33],"16424337","project\u002Fpositive\u002Fidea","AntonyGarand",[434,46,38,431,435,33],"16424837","lambda",[437,46,46,195,74,33],"16424953",[439,47,43,179,440,33],"16426320","Kequc",[442,47,46,195,443,33],"16427107","Illniyar",[445,47,43,179,446,33],"16427858","ry_ry",[448,38,33,449,450,33],"16424095","other\u002Fneutral\u002Fdocs","danschumann",[93,31,43,175,94,33],[453,454,43,455,456,33],"16422972",7,"project\u002Fcritical\u002Fperformance","tritium",[458,454,46,191,270,33],"16423253",[460,454,46,461,229,33],"16423624","project\u002Fneutral\u002Fperformance",[463,454,46,461,464,33],"16423929","alasdair_",[466,454,43,179,456,33],"16425002",[468,469,46,172,470,33],"16423721",8,"vbezhenar",[152,472,46,172,153,33],9,[474,472,46,195,94,33],"16423251",[476,472,46,172,206,33],"16423269",[478,472,46,461,479,33],"16423672","hughes",[481,482,46,172,483,33],"16423897",10,"fiatjaf",[485,482,46,172,94,33],"16423966",[487,168,46,172,488,33],"16424791","javajosh",[490,168,46,191,267,33],"16428171",[104,41,33,199,105,33],[493,494,46,172,495,33],"16423649",13,"paxy",[497,494,46,172,498,33],"16424001","rocqua",[500,494,43,501,502,33],"16424022","project\u002Fcritical\u002Fdocs","ktpsns",[111,504,46,195,112,33],14,[164,504,33,195,11,43],[507,504,46,195,508,33],"16424248","sbarre",[510,504,46,195,511,33],"16425007","15155",[513,514,46,191,515,33],"16422975",15,"Raphmedia",[517,514,46,191,56,33],"16422990",[519,514,43,381,515,33],"16423040",[521,514,46,172,153,33],"16423199",[523,514,46,172,524,33],"16426716","SpaceNugget",[526,514,33,527,11,43],"16423026","maker\u002Fneutral\u002Fexecution",[529,514,46,195,515,33],"16423382",[531,514,46,191,532,33],"16424238","ficklepickle",[77,534,38,431,78,33],16,[536,537,46,191,538,33],"16422932",17,"orliesaurus",[540,537,46,191,541,33],"16422966","guntars",[543,537,46,544,545,33],"16423065","project\u002Fneutral\u002Fnone","okanesen",[547,537,46,172,538,33],"16423139",[63,537,33,172,11,43],[550,537,38,551,538,33],"16423220","maker\u002Fpositive\u002Fnone",[553,537,46,172,94,33],"16423295",[555,556,46,195,557,33],"16425753",18,"sexy_seedbox",[559,560,33,356,561,33],"16423818",19,"moeadham",[563,560,33,356,564,33],"16423850","slantaclaus",[566,560,33,356,567,33],"16424568","B1FF_PSUVM",[569,570,38,431,426,33],"16426229",20,[572,34,43,179,573,33],"16422917","jandrese",[575,34,43,179,515,33],"16422986",[577,34,33,578,573,33],"16423094","other\u002Fneutral\u002Fdesign",[580,34,33,578,515,33],"16423205",[582,34,33,578,60,33],"16423254",[584,34,33,578,515,33],"16423348",[586,34,33,578,587,33],"16423378","notahacker",[589,34,33,578,515,33],"16423455",[591,34,33,578,587,33],"16423513",[593,34,46,195,594,33],"16423361","vlunkr",[596,34,46,195,498,33],"16424033",[598,34,46,191,90,33],"16424969",[600,34,46,191,446,33],"16427939",[602,603,33,604,605,33],"16423084",22,"other\u002Fneutral\u002Fprivacy","commandlinefan",[607,603,33,604,608,33],"16423105","booleandilemma",[610,603,33,199,611,33],"16423117","saagarjha",[613,603,33,199,605,33],"16423562",[615,603,46,195,616,33],"16425927","quickthrower2",[],[619,624,629,634,639,644],{"id":620,"name":621,"points":622,"category":623},"16409572","vue-ethereum-ipfs",245,"languages",{"id":625,"name":626,"points":627,"category":628},"16389609","viewimage",219,"dev_tools",{"id":630,"name":631,"points":632,"category":633},"16392096","OpenBSD Email Service",215,"infrastructure",{"id":635,"name":636,"points":637,"category":638},"16393566","Kismet",199,"consumer_social",{"id":640,"name":641,"points":642,"category":643},"16386173","Gnomecast",176,"creative",{"id":645,"name":646,"points":647,"category":633},"16431022","Mux Video",124,false,"v2",{"id":651,"name":5,"line":6,"ai":648,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":652,"top":18,"kw":653,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":654,"url":9,"mix":655,"praise":70,"objection":82,"sub":21},16422696,-0.15,[24,25,26,27],"1233322333333130001100322123323243431033",[31,32,33,34],1794036563572]