2 ms·
Oh the plight of a Windows user. I know what you're talking about with click jacking. The implication that a "true click" is any more likely to allow a JavaScr
by drivebyacct2 15y ago
Oh the plight of a Windows user.
I know what you're talking about with click jacking. The implication that a "true click" is any more likely to allow a JavaScript exploit to escape the browser sandbox is complete and utter bullshit. If you can give me one example, I won't scowl at the fact that 6 other people downvoted me without saying why.
- jerf 15y agoThink about why, if the attacker already has enough control over the page to put up a transparent iframe and bind a click event to it, why not just do the thing the attacker is trying to attack you with? And the answer is, the browser will stop them. It treats stuff that sources from a click differently. If it didn't, there would be no "clickjacking", the attackers would simply redirect you to the desired URL. The very existence of the term is evidence. It doesn't escape the sandbox, it gets raised privs from the sandbox by design.
- drivebyacct2 14y agoWhat? What on Earth does this have to do with vulnerabilities in the browser? Like I said, show me a single example of a vulnerability that is only exploited via a "true click". They DO NOT EXIST. It's hogwash. I'll say again, I know what you're talking about. It is NOT relevant in this discussion about vulnerabilities. Please show me an example otherwise.