Top all-time · #6290
Mike Gualtieri
Personal blog · mike-gualtieri.com/postssecurityweb
Mike Gualtieri's personal blog at mike-gualtieri.com covers security and web. Since 2018, 13 different Hacker News readers have linked it 17 times, most often “Stealing Data with CSS: Attack and Defense”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
Commenters cite Mike Gualtieri's posts as sources on CSS exfiltration, a way to steal data like passwords without JavaScript, and link his CSS exfil test tool and related posts.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Browse all 66 posts on Mike Gualtieri Homepage
Most-linked posts?
- Stealing Data with CSS: Attack and Defense9 people · 10 mentions · first linked 2018-02-08
- /css-exfil-vulnerability-tester3 people · 5 mentions · first linked 2019-05-08
What Hacker News says?
> Following up on this, I found an article[0] claiming that it isn't really an issue since a pure CSS keylogger can only catch one character. That reminds me of: • Stealing Data With CSS: Attack and Defense https://www.mike-gualtieri.com/posts/stealing-data-with-css-... • CSS Exfil Vulnerability Tester https://www.mike-gualtieri.com/css-exfil-vulnerability-teste... • CSS Exfil Protection (Firefox) https://addons.moz…
Comment linking /css-exfil-vulnerability-tester
on “Css-only-chat: A truly monstrous async web chat using no JS on the front end”Submitted Stealing Data with CSS: Attack and Defense as a story · 55 points
HN discussionYup, you'd have to have all permutations of any length password in the css file AND it would have to be pre-filled using the value attribute. The original post on this talks about it in more detail: https://www.mike-gualtieri.com/posts/stealing-data-with-css-...
Comment linking /posts/stealing-data-with-css-attack-and-defense
on “Show HN: A CSS Keylogger”Submitted Stealing Data with CSS: Attack and Defense as a story · 2 points
HN discussionYou'd have to have all permutations of any length password in the css file AND it would have to be pre-filled using the value attribute. The original post on this talks about it in more detail: https://www.mike-gualtieri.com/posts/stealing-data-with-css-... Summary: A method is detailed - dubbed CSS Exfil - which can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector. Due to the mo…
Comment linking /posts/stealing-data-with-css-attack-and-defense
on “Show HN: A CSS Keylogger”Submitted Stealing Data with CSS: Attack and Defense as a story · 2 points
HN discussionDomPurify by default allows style tags ( https://github.com/cure53/DOMPurify/blob/master/src/tags.js#... ) which can be used for tracking visits and some types of password extraction from certain types of frameworks (see https://www.mike-gualtieri.com/posts/stealing-data-with-css-... and https://github.com/maxchehab/CSS-Keylogging ). Also regarding these types of mitigations see https://www.youtube.com/watch?v=lG7U3…
Comment linking /posts/stealing-data-with-css-attack-and-defense
on “Don’t try to sanitize input – escape output”Submitted Stealing Data with CSS (2018) as a story · 1 points
HN discussionWas this also tested against the CSS Exfil Protection addon? [1][2] [1] - https://www.mike-gualtieri.com/css-exfil-vulnerability-teste... [2] - https://addons.mozilla.org/en-US/firefox/addon/css-exfil-pro...
Comment linking /css-exfil-vulnerability-tester
on “uBlock, I exfiltrate: exploiting ad blockers with CSS”Good work. There are some hardening options that you may be able to glean from ArkenFox [1] and Betterfox [2]. Another addon to consider listing is CSS Exfil protection [3a] CSS Exfil Test Site [3b]. [1] - https://github.com/arkenfox/user.js [2] - https://github.com/yokoffing/Betterfox [3a] - https://addons.mozilla.org/en-US/firefox/addon/css-exfil-pro... [3b] - https://www.mike-gualtieri.com/css-exfil-vulnerability…
Comment linking /css-exfil-vulnerability-tester
on “Hardening Firefox – a checklist for improved browser privacy”uMatrix is great because it doesn't just block scripts. You can block iframes, images, etc... You can also turn off stuff like webworkers. It's not perfect (I've noticed a few holes around how it manages cookies, for example), but it's really good. Removing scripts is nice, but if you're trying to prevent obscure attacks[0] or even common tracking techniques from 3rd-party sites, it's not enough. People look at Java…
Comment linking /posts/stealing-data-with-css-attack-and-defense
on “Major sites running unauthenticated JavaScript on their payment pages”I agree with the sentiment, but too many companies are using javascript. That said, I only enable ecmascript for sites that I do business with. If I don't know where the site owners work, I won't enable it. I make a few exceptions for a few sites under heavy scrutiny. Even CSS has some exfil risks, but there are browser addons to block that as well. [1] [1] - https://www.mike-gualtieri.com/css-exfil-vulnerability-te…
Comment linking /css-exfil-vulnerability-tester
on “‘Dark patterns’ are steering many internet users into making bad decisions”Worry about CSS-based exfil. https://www.mike-gualtieri.com/posts/stealing-data-with-css-... The security teams are correct in the training they run about these: report the suspicious email and leave the investigation to them, don't try to DIY the investigation. Note you aren't penalized for false positives (reporting a legitimate email as a phishing attempt).
Comment linking /posts/stealing-data-with-css-attack-and-defense
on “Should Failing Phish Tests Be a Fireable Offense?”There is a blog post here that describes how to exploit it: https://www.mike-gualtieri.com/posts/chaining-remote-web-vul...
Comment linking /posts/chaining-remote-web-vulnerabilities-to-abuse-lets-encrypt
on “Let's Encrypt issues its 3Bth cert”Yes [1] one can be pwned with CSS. There may also be some data leakage risks. [2] [1] - https://thejh.net/misc/website-terminal-copy-paste [2] - https://www.mike-gualtieri.com/css-exfil-vulnerability-teste...
Comment linking /css-exfil-vulnerability-tester
on “Can you get pwned with CSS?”The Side Channel Attack? JavaScript Zero: real JavaScript, and zero side-channel attacks https://blog.acolyer.org/2018/03/13/javascript-zero-real-jav... Side-Channel Attacks on Everyday Applications https://github.com/defuse/flush-reload-attacks The DrK (De-randomizing Kernel ASLR) attack https://github.com/sslab-gatech/DrK Cache Template Attacks https://github.com/IAIK/cache_template_attacks Using Node.js Event Loo…
Comment linking /posts/stealing-data-with-css-attack-and-defense
on “Ask HN: Secure Webassembly crypto?”
