4 ms·
This is wrong, IMO. The author states the main risk to LS data is an XSS vulnerability in the website. While true, an XSS in a website is pretty much a "game ov
by air7 9y ago
This is wrong, IMO.
The author states the main risk to LS data is an XSS vulnerability in the website. While true, an XSS in a website is pretty much a "game over" and allows the attacker to get any information and perform any action in the context of the site.
Essentially, if a website has an XSS your information is compromised no matter what mechanism the site uses to store it.
- brianhama 9y agoThat’s exactly what I was thinking also. Local storage is protected by the origin access policy. If that is compromised by XSS, it doesn’t matter how or where the data is stored; it’s accessible.
- Klathmon 9y agoIt doesn't even need to be "stored", an XSS attack can pull information that is simply displayed on the page. When it comes to web-apps, XSS is game over. It's the web equivalent of remote code execution.