4 ms·
There was a very nice attack regarding you being logged in to different websites by attempting to fetch crafted URLs that would be available only if you were l
by xtracto 6y ago
There was a very nice attack regarding you being logged in to different websites by attempting to fetch crafted URLs that would be available only if you were logged in.
Quite clever.
- alexpetralia 6y agoThis is called super logout.
- mahathu 6y agobut what would the issue be if some random site knew I was logged into google/amazon/facebook at the time?
- minitech 6y ago- consider that the same thing applies to sites that aren’t google/amazon/facebook that you might care about - it helps with fingerprinting - there’s no reason to allow it
- mahathu 6y agoGood points, especially the first one. Thanks.
- xtracto 6y agoGreat question. When I read about that i was working for an online lending startup. We briefly discussed on using such a feature as a signal for credit risk underwriting. The logic was that, maybe you were logged to Telcel or to Movistar, or to Liverpool vs Sears (Mexican retailers). That could give us signal on the probability of default