3 ms·
Protip for the paranoid: the author could nab your session cookie at the same time, too! :)
by crux_ 16y ago
Protip for the paranoid: the author could nab your session cookie at the same time, too! :)
- uxp 16y agoCould, but doesn't: http://github.com/erkie/erkie.github.com/blob/master/asteroids.js http://github.com/erkie/erkie.github.com/blob/master/asteroi... Though, it appears he was trying to implement high scores, which would send some information to another site, including document.location.href, but it is commented out in the version I linked, and removed in the minified version.
- crux_ 16y ago> Could, but doesn't Could, but doesn't yet. If you're not locally rehosting the 'known-good' version that you just audited, you're not being paranoid enough.
- Groxx 16y agoIf you're on the internet, you're not being paranoid enough. Though that's a good reminder :) Thanks for pointing it out!
- ck2 16y agoUse HttpOnly on critical cookies!
- crux_ 16y agoOkay, sure. :) A new protip for the paranoid: the author could phish the snot out of you with an overlay that made it look like Facebook needed a re-login, too!
- ck2 16y agoUse Secure Login for Firefox! https://addons.mozilla.org/firefox/addon/4429 https://addons.mozilla.org/firefox/addon/4429 (lol, seriously though, it highlights "real" login fields based on domain for the page/frame which can't be spoofed and does a one-click login rather than typing it in - you can't get "fooled" because you should never be typing anything)
- follower 16y agoHeh, yeah, when I saw it earlier I wondered how successfully people could use an approach like this to social engineer people in such a manner. Glad I'm not the only paranoid one. :)