3 ms·
I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker. It'll probably take them a while to catch everything. They cou
by colinsidoti 13y ago
I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker.
It'll probably take them a while to catch everything. They could easily kill any CSS that's hitting the #rapportive ID with regex, or by making the ID a unique random string on each email. I believe placing all the original content in a "position:relative; overflow: hidden;" would fix your overlay concerns. Definitely an annoying cat-and-mouse game, but since they're ultimately writing the email that ends up in your inbox, they should be able to consistently prevent this kind of attack.
- hamburglar 13y agoThe main problem is that it's a cat and mouse game that really should not be happening in people's email. Saying, "hey, it's no big deal that we're clumsily wanking with your email contents/security because we'll easily be able to fix any problems that arise" is less comforting than simply not clumsily wanking with your email contents/security in the first place.
- newman314 13y agoReplace "HTML/CSS injection" with the word spam and reread it again. If things were true, spam would have died out by now. Admittedly, companies like Gmail do a good job of controlling but sufficiently large volumes of spam get through to the point where it's being opened and clicked where spammers still consider this a viable business. So not, it's not a cat-and-mouse game where the owner wins. A sufficiently determined attacker will still get in. If your thesis were true, we would have built an unhackable computer by now.