3 ms·
This can leak the user's client by changing links per client. Make a link per identifiable client, show only the one for the current client, and give each link
by kecks 11y ago
This can leak the user's client by changing links per client.
Make a link per identifiable client, show only the one for the current client, and give each link a post/get parameter identifying the client. Quite easy to do, but a lot of work to have broad client support.
Tada! I now know you read your email on your [obscure and bugged client], which is susceptible to [this and that exploit].
- Houshalter 11y agoWhy not just insert the exploit into the first email? What do you gain by identifying the client?
- kecks 11y agoThis is an exploit as well, just a different kind. It doesn't require any programming errors in the clients, instead it relies on the non-standardization of clients.