I'm delighted to introduce Alex, my fellow swigger who I've collaborated with in the past with tools like DOM Invader. He showed me that it's possible to exfiltrate larger tokens than demonstrated in

When Gareth previewed CSS: the bomb inside your inbox I was blown away. He could steal a login token with CSS alone, without having to recursively load another stylesheet for every character. Then I watched the browser wrestle with roughly 250 MB of CSS to recover a 12-character hex token. It worked. But such a large payload for 12 characters made me think there must be a better way.