3 ms·
How is JavaScript injection not a huge security flaw? JavaScript injection -> acquire session -> basically anything (within the context of twitter)
by vanschelven 16y ago
How is JavaScript injection not a huge security flaw? JavaScript injection -> acquire session -> basically anything (within the context of twitter)
- niekmaas 16y agoHe means that his example is pretty harmless, not the flaw itself. As you state the potential of the flaw is huge!
- thenduks 16y agoIt's clearly a huge security flaw, but as you say -- only within the context of twitter. Looking at the big picture of my life something like this doesn't even register. What's the worst thing that could happen, really? A popup? Maybe my account gets stolen somehow? Some garbage tweets in my timeline that I delete later with a non-web client? All of the sudden I'm following some spammers... I'd get over it.
- semanticist 16y agoYou could send a DM to everyone you know with an shortened URL that links to a page full of malware and evil that pwns their computer, steals all their data and account log ins, and uses their machine as part of a botnet. Because the DM would come from you, a person they know, the person is more likely to trust the page or file that's linked to and less likely to catch it brutalising their computer. The actual data on your Twitter account might not be valuable in itself, but it has significant value as a vector for other attacks.