4 ms·
https targets for forms on http pages are a security anti-pattern. The Tunisian government keylogged people's Facebook details because of it.
by mukyu 16y ago
https targets for forms on http pages are a security anti-pattern. The Tunisian government keylogged people's Facebook details because of it.
- tptacek 16y agoThis is exactly correct. Security teams at our clients routinely "flunk" applications because they fail to set the "Secure" flag on cookies; this flaw is even worse than that one.
- natrius 16y agoIf you were completely unaware that this happened like I was, here's the story: http://www.theatlantic.com/technology/archive/2011/01/the-inside-story-of-how-facebook-responded-to-tunisian-hacks/70044/ http://www.theatlantic.com/technology/archive/2011/01/the-in... A javascript keylogger was inserted into pages served over plain HTTP. Here's the source: http://www.hackerzvoice.net/node/105 http://www.hackerzvoice.net/node/105 With a little more tact and obfuscation, I bet an attacker could get away would doing that on a large scale for quite some time.