3 ms·
"The lifesaver was a technique developed at AdSafe: The key to the solution was the ability to read the address of the top frame that was hosting the ad(). ()
by code_duck 16y ago
"The lifesaver was a technique developed at AdSafe: The key to the solution was the ability to read the address of the top frame that was hosting the ad().
() For the technically curious: reading the address of the top frame is a challenging problem. For security reasons, browsers do not allow cross-domain scripting. So, it is not possible to just call the "top" object and read its properties. We have a proprietary solution for this."
Am I correct in reading this as they're relying on JavaScript security exploits?
- Panos 16y agoYes and no. No, because it cannot be used as an exploit. Yes, because it allows you to read the address of the "top" object. Consider it similar to the CSS link-color hack to read the past browsing history of a user.
- code_duck 16y agoBy 'exploit' I mean bending the rules, or skirting restrictions. Information disclosure, not code execution. They are taking advantage of flaws in browsers in order to gather information which is not supposed to be available. I assume this same method could be used by people with less savory goals, but this company isn't reporting the security flaws in browsers that let them do this as it would make things more difficult for their business. I probably wouldn't go around telling everyone if it was me.