4 ms·
The pessimist inside me worries about whether this could be used to lure people into revealing their credentials; granted, there are thousands of ways to do thi
by algasami 2y ago
The pessimist inside me worries about whether this could be used to lure people into revealing their credentials; granted, there are thousands of ways to do this easily, but I'm still cautiously optimistic on this topic.
- cjaybo 2y agoSaw an interesting case of this type of attack in the CounterStrike community earlier this week. Someone setup a fake tournament website that asked the user to login with their Steam account. Then it launched what looked like a new browser window with the Steam login page, but was actually just a popover that had been elaborately styled, with window decorations and all.
- codelikeawolf 2y agoSo I think this API would just allow a bad actor to get your credentials in a way that adheres to accessibility guidelines. It doesn't enable them to do anything they couldn't do before programmatically.