4 ms·
There is an air of arrogance to the article that isn’t explained. Why is the implementation so weak and how should it have been done? Or rather: are passwords a
by mosselman 8y ago
There is an air of arrogance to the article that isn’t explained. Why is the implementation so weak and how should it have been done? Or rather: are passwords at risk? Is there an actual possible attack? Is this explained already and am I missing it?
- palant 8y agoAs mentioned in the article, I'm bad at reverse engineering. I merely point out the massive attack surface, and I'm pretty certain that this can be misused into infecting users with malware. But that's up to other people to prove, I'm not going to sink more time into this that nobody is going to pay for. How it should have been done: stay in the JavaScript sandbox for all the logic, rely on the browser's existing functionality, use an absolutely minimal communication interface to the application.