3 ms·

Does anyone have a (non-malicious) example of this sort of "attack"? I don't quite get it; some people are mentioning Javascript, but the description sounds mor

• gruez 9y ago
  >Presumably such leading junk is hidden in the rendered page, making the user think they're on MyBank.com? it's even simpler than that, they add a bunch of spaces after the "fake" url to pad out the actual payload so it doesn't show in the urlbar. any issues with the page content can be fixed with document.write or whatever.
• tetromino_ 9y ago
  See https://twitter.com/tomscott/status/812265182646927361 https://twitter.com/tomscott/status/812265182646927361 The phishers are using a URL like `data:text/html,https://example.com/account/xxxxx https://example.com/account/xxxxx (lots of spaces here) <script>/* phish phish phish */</script>` You won't see that scary <script> in the URL unless your browser window is super-wide.
• Grollicus 9y ago
  I know of a website that decrypts all its content clientside and uses this (i think) as a mechanism for a user to download his own attachments. The Idea is that the whole website could be a static file somewhere and the webserver is only a key value store that has no idea what it is saving. Doesn't work that way currently because file:/// doesn't allow ajax calls to somewhere else but that's a solveable problem. Generally, every download that gets generated clientside by the JS is hit by this
  • fzzzy 9y ago
    This does not affect downloads of data urls, only navigation to data urls.