2 ms·
The danger is not that malicious websites figure out where you've been, the danger is that a malicious website could poison the cache for a critical piece of JS
by sbierwagen 11y ago
The danger is not that malicious websites figure out where you've been, the danger is that a malicious website could poison the cache for a critical piece of JS used in, for example, gmail. Visit a malicious site, boom, Russians can read your email.
- pdkl95 11y agoThis would require generating collisions for hash (e.g. sha385). We can trust the hash because SR?I already assumes the hash function works in the integrity="" attribute.
- nitrogen 11y agoI think both of these things (history snooping, XSS), plus the Dropbox problem of injecting a hash without ever actually having the file, will need to be addressed.