4 ms·
Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get acces
by rgaucher 15y ago
Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get access to my-cool-site.com DOM, if you're leveraging this bug.
- e28eta 15y agoBut, my-hacker-site.com could, instead of including an iframe to my-banking-site.com, simply do a server-side proxy of your bank and execute a pretty effective phishing attack. The advice I've seen re:phishing is usually to check the URL. That doesn't help here.
- azov 15y agoCheck the URL is not a solid advice, there are many ways to trick you (e.g. google.com vs goog1e.com). Enter the URL yourself is a better one.
- deleted 15y ago[deleted]