4 ms·
They cynical side of me notes what a great phish this could be. People are inclined to enter passwords they regularly use just to see the visualization of their
by travisgriggs 5y ago
They cynical side of me notes what a great phish this could be. People are inclined to enter passwords they regularly use just to see the visualization of their favorite passwords. With a little logging -> send home, you'd be harvesting passwords left and right.
- peanut_worm 5y agois a password very useful without any other identifier though?
- deleted 5y ago[deleted]
- grp000 5y agoWould the type of people amused by this have that weakness though?
- hbn 5y agoIt's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home. Unless there's a workaround I'm not thinking of.
- heartbeats 5y agoCan't you embed off-site images?
- jamespwilliams 5y agoGitHub pages are served with Access-Control-Allow-Origin: *, so the SOP doesn’t apply. They also don’t set a CSP header, which opens up the opportunity to exfiltrate data by other means, e.g having the browser load an image on your.site/$password.jpg.
- hbn 5y agoAh right. Simple!
- Sohcahtoa82 5y agoThe CORS policy is set by the server receiving the request, not the page/server sending it.
- thebruce87m 5y agoWell damn, I’ll have to change Hunter2 everywhere now.