4 ms·
Only because gmail enforces somewhat safe passwords. Does it look them up in a dictionary though? You could probably harvest even long-ish dictionary-based pass
by pmjordan 18y ago
Only because gmail enforces somewhat safe passwords. Does it look them up in a dictionary though? You could probably harvest even long-ish dictionary-based passwords this way if an attacker manages to embed this in a sufficiently high traffic page.
- tptacek 18y agoI don't think you get it. If you could guess a user's password, why would you bother with this elaborate CSRF attack?
- pmjordan 18y agoFair point. I guess if you had access to a botnet, you could attempt a similarly broad attack; with this you'd only need access to a popular, less scrupulous site. (porn, torrent/warez, etc. sites spring to mind)