CSS: The bomb inside your inbox

>When the user types this command Atlas will open some browser tabs and exfiltrate the victim's name from the current web page and send it to a remote server via the hash.

But the remote server doesn't see the hash? This casts doubt into the content, since the attack was clearly not tested. Am I missing something?

It's a pretty interesting post though, but hardly surprising - touching and rendering untrusted content is always risky.

Reading the article, I kept thinking: "could you defeat this with an iframe?", and indeed:

> One of the best methods to protect against these attacks is strict isolation. If you isolate the email message using sandboxed iframes you restrict the ability to break out of trusted boundaries. If you are not using sandboxed iframes, always be careful when allowing custom attributes and check for HTML/CSS gadgets. Use a strict allow list of characters when validating keywords and names to avoid mutation when using the CSSOM.

iframes should be the first layer of any defense-in-depth against user-submitted content.

This website was pretty nasty to my browser history and pretty much kidnapped my tab on mobile safari.

One thing I've found that purports to address (some of) these risks: https://mail.cock.li/cock-mail/

Haven't tried it yet though, done some reading but don't know enough to be sure their proposed paradigm is valid.

I view email in Thunderbird and have uBlock installed. Sadly the CSS Exfil addon for Firefox does not exist for Thunderbird but I view emails in plain text either way. I suppose I "miss out" on backgrounds, themes, animated GIFs. For me personally plain text is the way to go. Am I the only one using an email client these days? I prefer the client so I can keep my emails off the server and manage my own backups.

Would a hard isolation model for HTML email be a better long-term solution, or is that impractical for reasons I’m missing?

> This page requires JavaScript for an enhanced user experience.

Yeah no shit.

Allowing anything other than plain text in email bodies was a terrible mistake.

> In this section I targeted Fastmail, ProtonMail, Gmail, Cowork and Slack.

Oh that's all, is it?