3 ms·

I must not be understanding this correctly. The script is triggered when the user attempts to search for text on the page. When would a user search for their

I must not be understanding this correctly. The script is triggered when the user attempts to search for text on the page. When would a user search for their pw's?

baddox 14y ago
I'm confused as well, but the only time I can imagine doing that is when there's a big leak of passwords (like LinkedIn a while back) and I want to check if my password is among those leaked.
- damncabbage 14y ago
  There are two linked examples of this in the article: * http://h43z.koding.com/blog/leaked.html http://h43z.koding.com/blog/leaked.html * http://boomer.neohapsis.com/searchbox/index.html http://boomer.neohapsis.com/searchbox/index.html
  - readme 14y ago
    :| I might have fallen for this before. Can't say for sure. Change all the things!
freditup 14y ago
I've actually seen links on hackernews that go to these big data dumps of information. Presumably, you'd check to see if your info was leaked using the browser's find mechanism. A clever enhancement is that as you type, JS on the page actually inserts whatever you're typing into the content of the page. So you won't ever just type the first few characters of your password and see it's not there, you'll always find your info or similar info on the page. I agree that it does seem a touch unlikely to work in the real world. However, I think a scammer with a touch of ingenuity, creativity, and programming knowledge could probably construct a realistic enough scenario to fool many people.
InclinedPlane 14y ago
Look at the example pages. Because the exploit pages are lists of leaked passwords, or cc#s. So to check if their password has been leaked they would naturally search for their password. This is just a very slick implementation of the old "enter your credit card number to see if it's been stolen" technique, except the end-users don't realize that they've given anything away. Here's an analogy: you get a phone call from someone telling you that your bank account has been hijacked and you need to visit your local branch right away to fix it. So you drive to your bank, enter, and you go talk to a bank employee. As he sits at a computer he asks you for your bank account number, home address, and social security number. After typing them in and hitting a few buttons he tells you that your account has actually not been hijacked and you're safe, so you head home and go watch tv. Meanwhile, what actually happened is that you didn't realize that it was a bank holiday and con-men had broken into the bank and dressed up as bank employees to trick you into giving out your personal information.
- deleted 14y ago
  [deleted]

I must not be understanding this correctly. The script is triggered when the user attempts to search for text on the page. When would a user search for their pw's?

baddox 14y ago

I'm confused as well, but the only time I can imagine doing that is when there's a big leak of passwords (like LinkedIn a while back) and I want to check if my password is among those leaked.

damncabbage 14y ago
There are two linked examples of this in the article: * http://h43z.koding.com/blog/leaked.html http://h43z.koding.com/blog/leaked.html * http://boomer.neohapsis.com/searchbox/index.html http://boomer.neohapsis.com/searchbox/index.html
- readme 14y ago
  :| I might have fallen for this before. Can't say for sure. Change all the things!

freditup 14y ago

I've actually seen links on hackernews that go to these big data dumps of information. Presumably, you'd check to see if your info was leaked using the browser's find mechanism. A clever enhancement is that as you type, JS on the page actually inserts whatever you're typing into the content of the page. So you won't ever just type the first few characters of your password and see it's not there, you'll always find your info or similar info on the page. I agree that it does seem a touch unlikely to work in the real world. However, I think a scammer with a touch of ingenuity, creativity, and programming knowledge could probably construct a realistic enough scenario to fool many people.

InclinedPlane 14y ago

Look at the example pages. Because the exploit pages are lists of leaked passwords, or cc#s. So to check if their password has been leaked they would naturally search for their password. This is just a very slick implementation of the old "enter your credit card number to see if it's been stolen" technique, except the end-users don't realize that they've given anything away. Here's an analogy: you get a phone call from someone telling you that your bank account has been hijacked and you need to visit your local branch right away to fix it. So you drive to your bank, enter, and you go talk to a bank employee. As he sits at a computer he asks you for your bank account number, home address, and social security number. After typing them in and hitting a few buttons he tells you that your account has actually not been hijacked and you're safe, so you head home and go watch tv. Meanwhile, what actually happened is that you didn't realize that it was a bank holiday and con-men had broken into the bank and dressed up as bank employees to trick you into giving out your personal information.

deleted 14y ago
[deleted]