3 ms·
They won't get secure cookies [for the site they're attacking], though they could plausibly redirect the user to a similar-looking HTTPS domain under their cont
by konklone 11y ago
They won't get secure cookies [for the site they're attacking], though they could plausibly redirect the user to a similar-looking HTTPS domain under their control and get permissions requiring a secure origin.
- JoshTriplett 11y agoTrue, but they won't get permissions that the user grants on a site-by-site basis, which also means the attack can't silently happen in the background.