3 ms·

michaelmior is completely right. You don't need xss on login page. You can have xss on any page and open an iframe/window with login and then steal via same or

by homakov 14y ago

michaelmior is completely right. You don't need xss on login page. You can have xss on any page and open an iframe/window with login and then steal via same origin

kaolinite 14y ago
Ok, fair point, but even so - it's still not as much of a concern as other XSS and auto-complete vulnerabilities.
- homakov 14y ago
  XSS is ok. CSRF is ok. Losing my real password is the worst thing to happen