4 ms·
It seems strange that you can use a browser bug to get into a site. Since the browser's outside of FB's control (i.e. theoretically anyone could write their ow
by JohnLBevan 14y ago
It seems strange that you can use a browser bug to get into a site. Since the browser's outside of FB's control (i.e. theoretically anyone could write their own, including one which said it was Chrome but had been created for malicious purposes) any security protocol should not rely on browser implementations.
- wuest 14y agoIt's only strange at first sight. If your site depends upon browser-specific features as the sole source of a security mechanism, it stands to reason that it will turn into pain for you. This is another solid example of the lesson: if the user controls it, the input is malicious. Always.
- mimiflynn 14y agoThis isn't unprecedented. IE6 has been used to attack websites in the past. http://www.theregister.co.uk/2010/02/01/ie6_microsoft_uk_government/ http://www.theregister.co.uk/2010/02/01/ie6_microsoft_uk_gov...
- at-fates-hands 14y agoMax Butler is famous for using the HTML application in IE to harvest credit card information way back in 1999.
- wolframarnold 14y agoThe way I understood the article is that this relies on harvesting data from users on your site. As you cannot control which browser your users have, the point here is that this exploit relies on a vulnerability in a mass-adopted browser.
- capsule_toy 14y agoI'm not sure what you're suggesting when you suggest not relying on browser implementation. This sounds impossible as the browser is the client and the client will have access to user credentials.