2 ms·
It's not the link fragment portion of the URL in the address bar that is sent to DNS, it is DNS requests from additional lazily-loaded content that is pulled up
by password4321 4y ago
It's not the link fragment portion of the URL in the address bar that is sent to DNS, it is DNS requests from additional lazily-loaded content that is pulled up when the browser jumps down to it.
Someone else went into detail: https://news.ycombinator.com/item?id=32742504 https://news.ycombinator.com/item?id=32742504
- illiac786 4y agoThis requires the attacker to have third party content on the page you are trying to get the user to scroll through, that is a huge assumption no? The password web page example is here highly unlikely: if the attacker injected his external content on the password web page, he has already a very strong position - getting users to click on links is not a logical next step, the attacker has far better avenues I would assume. At least that's my understanding.