[Blink]

Saw this a while back.  Pretty clever, it's one of those things that seems obvious once you learn of it.

For a method to take place like this, what is the point of disabling JS. Even if you disable it and think you're safe, your personal information is still in a risk situation.

JS is totally different.  This CSS method is only dangerous when used as XSS or if used in Stylish/Stylus.  With JS, real exploits can be used, like in the case of Spectre (which was patched by making JS' timing functions less accurate).  With this, there isn't as much risk.

Oh for sure on your statement. It's honestly shocking to hear since, Most people wouldn't know about this due to what CSS is.

(un)Surprisingly enough, CSS with HTML is Turing complete: https://github.com/elitheeli/stupid-mach...er/rule110