3 ms·
tl;dr; XSS is a security hole.
by eloisant 14y ago
tl;dr; XSS is a security hole.
- homakov 14y agotrue! and it happens. but stealing real password is a security HOLE IN FORCE 2
- jerf 14y agoToo glib. In security, you want defense in depth, because what you thought was your perfect perimeter never is. It is fair to discuss whether or not there is anything a browser can do to mitigate this, even in the face of a security violation. Hence things like domain policies on AJAX use... in theory they are never necessary because everybody's perfectly secure, right? I suspect that other's analysis that the proposed solution is impossible is correct, and JS needs access to the prefilled in password for a lot of auth to work. But it's a valid discussion, and is not rendered moot by simply observing that another security violation has already occurred.
- homakov 14y agoupdated the post