3 ms·

That's a bit unworkable, particularly as you can get many sites to load a user into memory by putting a post-auth URL into an IMG tag anywhere on the Internet.

by patio11 13y ago

That's a bit unworkable, particularly as you can get many sites to load a user into memory by putting a post-auth URL into an IMG tag anywhere on the Internet. Your browser will obediently GET that URL, passing along the session cookie to the legitimate server, where it will then be exfiltrated via heartbleed. Basically: this vulnerability must be patched, or the server must be taken offline, and that needs to happen everywhere.

shock-value 13y ago
> Basically: this vulnerability must be patched, or the server must be taken offline, and that needs to happen everywhere. No one is arguing against that. The point is that from the user's point of view, they shouldn't interact with a server at all if it is still vulnerable to this attack.