4 ms·
> Again...you'd already have to know the email address and what benefit does it give you to know that this specific person is logged in? You can link users (th
by askmike 9y ago
> Again...you'd already have to know the email address and what benefit does it give you to know that this specific person is logged in?
You can link users (that you target) to specific websites (that you indirectly control, even through something like a malicious ad).
> The only people that would be able to gather this information from this exploit are Reddit admins and they'd already have that information from the email address. Even still... what would they even do with that information?
No! I (as a non admin) could create a website that uses this exploit right now and link targets (like reddit admins of which I know the gmail) to my website. Post the website to reddit, and voila. Once they visit the site I know they did.
- dpkonofa 9y agoAnd again, I ask... What information or benefit does that give you that you didn't know before? This only works on specific people and targets that you've had to identify before using this. I have yet to hear of a specific example of this being used for nefarious purposes outside of confirming that someone visited a page and there are hundreds of ways to do that without needing to invoke this workaround.
- askmike 9y agoCould you give me any other example of an exploit that allows an attacker to tell that a specific gmail user is on a website?