This type of attack has been possible for years, but wasn't really replicating until the advent of social networking. Here is the bug I filed with Mozilla the f

This type of attack has been possible for years, but wasn't really replicating until the advent of social networking. Here is the bug I filed with Mozilla the first time I saw this type of attack in the wild: https://bugzilla.mozilla.org/show_bug.cgi?id=527530 https://bugzilla.mozilla.org/show_bug.cgi?id=527530 There is a lot of interesting discussion in the thread, and Brendan Eich shows up to throw up his two cents in as well. Also, here is my blog post discussing an attack scenario: http://www.nathanhammond.com/social-engineering-issue-with-javascript-urls http://www.nathanhammond.com/social-engineering-issue-with-j...