Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Monday June 04 2018, @07:34PM   Printer-friendly
from the when-more-is-not-better dept.

Submitted via IRC for SoyCow3941

Some of the recent additions to the Cascading Style Sheets (CSS) web standard are so powerful that a security researcher has abused them to deanonymize visitors to a demo site and reveal their Facebook usernames, avatars, and if they liked a particular web page of Facebook.

Information leaked via this attack could aid some advertisers link IP addresses or advertising profiles to real-life persons, posing a serious threat to a user's online privacy.

The leak isn't specific to Facebook but affects all sites which allow their content to be embedded on other web pages via iframes.

The actual vulnerability resides in the browser implementation of a CSS feature named "mix-blend-mode," added in 2016 in the CSS3 web standard.

The mix-blend-mode feature allows web developers to stack web components on top of each other and add effects for controlling to[sic] the way they interact. As the feature's name hints, these effects are inspired by the blend modes found in photo editing software like Photoshop, Gimp, Paint.net, and others. Example blend modes are Overlay, Darken, Lighten, Color Dodge, Multiply, Inverse, and others.

The CSS3 mix-blend-mode feature supports 16 blend modes and is fully supported in Chrome (since v49) and Firefox (since v59), and partially supported in Safari (since v11 on macOs and v10.3 on iOS).

Source: https://www.bleepingcomputer.com/news/security/css-is-so-overpowered-it-can-deanonymize-facebook-users/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Insightful) by VLM on Monday June 04 2018, @08:45PM (1 child)

    by VLM (445) Subscriber Badge on Monday June 04 2018, @08:45PM (#688559)

    The browsers should be making the layout decisions

    Or the page designers should by uploading a giant PNG/GIF of the entire page and imagemap for links.

    Instead we have the worst of both worlds with a hypertext markup language crippled by graphics arts special purpose computer language.

    Its one of those situations where the status quo is indistinguishable from a sabotage design made by an enemy. Which kind of resembles left-wing political thought (couldn't avoid that obvious one, LOL).

    Seriously though it is funny that both web development and left wing politics appear to be (mis)led by a cabal of their greatest enemies trying to sabotage them.

    As if everyone at FOSS organizations like github is on the Microsoft payroll, LOL. Actually, thats not so funny...

    Starting Score:    1  point
    Moderation   +1  
       Troll=1, Insightful=1, Interesting=1, Total=3
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3  
  • (Score: 4, Interesting) by bob_super on Monday June 04 2018, @09:32PM

    by bob_super (1357) on Monday June 04 2018, @09:32PM (#688590)

    > Or the page designers should by uploading a giant PNG/GIF of the entire page and imagemap for links.

    That would likely save you bandwidth and time.
    But the guy serving the website wants to save himself bandwidth (scripts hosted elsewhere) and time (you do all the layout stuff).

    I was at a video industry conference, where a very proud guy was pointing out that running the DRM fingerprinting code on the customers' machines is great savings for the provider. If Henry Ford had been one of those guys, everyone would be assembling car kits in their yards to save Ford a few bucks.