3 ms·
What flaws allow sites to hijack passwords if pages aren't programmable? Are you talking about phishing, and how would js help? My mental model here is that th
by ndriscoll 4y ago
What flaws allow sites to hijack passwords if pages aren't programmable? Are you talking about phishing, and how would js help?
My mental model here is that the browser's password manager autofills a password that the user doesn't even know, and without scripting or dynamic resources, it's not possible to exfiltrate that data automatically. Without styling, form buttons would have a standard look so it's harder to trick the user into submitting something without knowing (c.f. the recently posted fake captcha that tricks users into revealing the visited state of links).
- shadowgovt 4y agoHTML and CSS alone allow you to concoct a webpage where a user's input appears to be going to one place but is in fact going somewhere else. https://en.wikipedia.org/wiki/Framekiller https://en.wikipedia.org/wiki/Framekiller
- ndriscoll 4y agoThe OP link is a browser that doesn't support CSS. Not supporting frames seems like it'd also solve that problem. Edit: also, in a modern browser, passwords are autofilled by the browser which knows where input is going and can't be tricked. You could make an argument about other sensitive information, but that sounds like it's the same as plain ol' phishing.
- shadowgovt 4y agoAgreed. Unfortunately, there's no language for querying the client "Do you support CSS" / "Do you support frames" without CSS so Google is forced to err on the side of caution and reject browser that don't support JS (because they can query that).