4 ms·
An attacker could already simply redirect the form or post silently via XHR to gather the password, even if you didn't save your password before. This is not ve
by the_gipsy 14y ago
An attacker could already simply redirect the form or post silently via XHR to gather the password, even if you didn't save your password before. This is not very useful.
- zxcdw 14y agoUseful or not, it's yet another way. Yet another tool in the arsenal. Yet another quirk to worry about.
- icebraining 14y agoThe way is the same: getting rogue JS to run on your page. If the attacker gets that, it doesn't really matter how many ways they have to copy the password.
- homakov 14y agoGood catch, thanks. Changing 'action' param is very useful trick. I guess limitation should restrict action to same domain of current page..