
You can write a keylogger in pure CSS - AndrewDucker
https://twitter.com/captbaritone/status/966051583132758016?s=09
======
odabaxok
Dupe:
[https://news.ycombinator.com/item?id=16422696](https://news.ycombinator.com/item?id=16422696)

------
HugThem
No, you can't.

You can uses CSS as part of a keylogger in conjunction with Javascript that
triggers your selectors based on keypresses.

There are sites that already ship javascript that change attributes that
trigger selectors on certain keypress events. So by adding 'pure css' to
_these_ sites one would be able to log keystrokes on certain fields.

One example is Instagram. It ships Javascript that changes suitable attributes
of the password field on every keystroke. So adding the right CSS to Instagram
could result in passwords being logged.

------
nukeop
I don't see how this is an attack unless you load random third party
stylesheets yourself. It's the webmaster's role to ensure that css sheets
included on the website do not contact dodgy third party domains.

It also won't work on vanilla html inputs, it has to be controlled by
javascript in which case the javascript already has access to this information
anyway (and much more).

------
gmueckl
Does anyone know how this interacts with form auto-filling?

------
AllegedAlec
Why does CSS even have access to this stuff?

------
petraeus
*with the use of JS

