3 ms·
There are some good reasons in here (especially privacy), but I'm not convinced by the security point. It seems like the example linked about British Airways wa
by paulgb 6y ago
There are some good reasons in here (especially privacy), but I'm not convinced by the security point. It seems like the example linked about British Airways was JS under the britishairways.com domain being changed, not a third party CDN.
Incidentally, a few years ago when people were loading third party scripts over HTTP, I demoed a fun hack where, if you control a user's DNS, you could redirect queries to popular CDNs to a proxy that injects keylogger code and tells the browser to cache it indefinitely. Because at the time almost every site included either jQuery or Google Analytics, you'd have a persistent keylogger even after the user switched to a more secure connection. How far we've come!
- Felk 6y agoIs that demo of yours available somewhere? It sounds interesting and I'd love to read up on it
- paulgb 6y agoI was able to find a video of it: https://www.youtube.com/watch?v=_BUg9NzdLd4 https://www.youtube.com/watch?v=_BUg9NzdLd4 I think this is the code: https://github.com/paulgb/cachebeacon https://github.com/paulgb/cachebeacon It basically just runs two servers: - A DNS server that resolved a list of domains to its own IP. - An HTTP server that looked at the HTTP host and proxied requests to the upstream server. If the content type or extension indicated that the response was JavaScript, it would add the payload and set cache headers to cache as long as possible. - A special HTTP endpoint on the proxy server to capture data sent back from the payload.