4 ms·
What about attack vectors like this one (from the paper)? For example, in Thunderbird and Postbox we can completely redress the UI with CSS and tri
by dbrgn 8y ago
What about attack vectors like this one (from the paper)?
For example, in Thunderbird and Postbox
we can completely redress the UI with CSS
and trick the user into submitting the
plaintext with an HTML form if he clicks
somewhere into the message.
That sounds like something that can easily happen, even with remote content disabled.
(Edit: Formatting)
- middleclick 8y agoWouldn't disabling HTML email take care of this?
- dbrgn 8y agoYes, but that's probably something most people won't do (with the prevalence of HTML email and no plaintext alternative). Also, it was a reply to the parent who stated "If you disable remote content, it can't be exploited on thunderbird". Ruling out the presence of an exfiltration channel is hard. It's better to prevent rendering of messages with invalid authentication code in the first place (and not rendering it and showing a warning).
- jcranmer 8y agoThe HTML form submission vector has been fixed in Thunderbird.