3 ms·
If a third party is able to run arbitrary JavaScript in your browser / on a login page, isn't it already game over?
by brown9-2 15y ago
If a third party is able to run arbitrary JavaScript in your browser / on a login page, isn't it already game over?
- SwellJoe 15y agoYou've misunderstood the context. This is passwords that are handed over to a third party (but in a "masked" form). It's not your browser you're worried about...it's the browser of the person you handed the password to, without trusting them to actually know the password. Due to numerous methods of figuring out the password anyway, some of which the author documented, this would be an irreparably insecure feature.