> Every site you visit in a browser can attack every site you're logged into, but they have to know the URL scheme of those logged in sites. That's assuming no

> Every site you visit in a browser can attack every site you're logged into, but they have to know the URL scheme of those logged in sites. That's assuming nobody uses anti-CSRF measures, right? If I've got an anti-CSRF token on a form, how are you going to attack it? Or what about pages (e.g., change password pages) that require you to enter your password? Certainly you'd need to know more than the URL scheme.