4 ms·

There is a similar flaw that doesn't rely on CSP that I wrote about a few years ago. It seems that this is a fundemental problem with the web. I don't think it

There is a similar flaw that doesn't rely on CSP that I wrote about a few years ago. It seems that this is a fundemental problem with the web. I don't think it will ever be fixed. https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Information https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Pri...

pbhjpbhj 12y ago
Doesn't detect my logged-in state at FB, thought it might be noscript but even enabling globally still doesn't allow the page to discover my FB login. FF30 on Kubuntu.
- x1798DE 12y ago
  It also incorrectly detects me as being logged in to twitter when I selectively allow javascript for the grepular.com domain, but not for twitter.com or facebook.com. Interestingly, it does say (correctly) that I'm not logged in to facebook.com. Not sure what the difference is.
- mike-cardwell 12y ago
  Did you read the first paragraph on the page? "Update: Some of the example tests on this page no longer work (I don't have a Facebook account anymore and the Twitter URL I used went offline). The technique it's self is still alive and relevant though."
  - pbhjpbhj 12y ago
    Yes, I hadn't processed it completely but it says that he doesn't have an FB account - at the time of the update - so can't confirm if it works, but that some examples may/do not work. Admittedly it's not the most inciteful post ever but it gives a data point demonstrating that a reportedly non-tested suspect example failed. If you were looking for a FB login verification method then ...
brlewis 12y ago
This is a design problem with img elements, but it looks mostly fixable to me. If browsers sent an "I'm expecting this to be an image" header, possibly even just Accept: image/*, and servers took advantage of this information to avoid leaking info to 3rd parties, then flaws like this would only exist for image resources.
SunboX 12y ago
Is there any chance to check logged in facebook users? As far as I can see, all photos uploaded to facebook are public. Even if you restrict your page/posts using age or country - everyone can see the shared picture if he loads the url directly. So facebook is "save" for this exploit, but should restricted photos be public available?

pbhjpbhj 12y ago

Doesn't detect my logged-in state at FB, thought it might be noscript but even enabling globally still doesn't allow the page to discover my FB login. FF30 on Kubuntu.

x1798DE 12y ago
It also incorrectly detects me as being logged in to twitter when I selectively allow javascript for the grepular.com domain, but not for twitter.com or facebook.com. Interestingly, it does say (correctly) that I'm not logged in to facebook.com. Not sure what the difference is.
mike-cardwell 12y ago
Did you read the first paragraph on the page? "Update: Some of the example tests on this page no longer work (I don't have a Facebook account anymore and the Twitter URL I used went offline). The technique it's self is still alive and relevant though."
- pbhjpbhj 12y ago
  Yes, I hadn't processed it completely but it says that he doesn't have an FB account - at the time of the update - so can't confirm if it works, but that some examples may/do not work. Admittedly it's not the most inciteful post ever but it gives a data point demonstrating that a reportedly non-tested suspect example failed. If you were looking for a FB login verification method then ...

brlewis 12y ago

This is a design problem with img elements, but it looks mostly fixable to me. If browsers sent an "I'm expecting this to be an image" header, possibly even just Accept: image/*, and servers took advantage of this information to avoid leaking info to 3rd parties, then flaws like this would only exist for image resources.

SunboX 12y ago

Is there any chance to check logged in facebook users? As far as I can see, all photos uploaded to facebook are public. Even if you restrict your page/posts using age or country - everyone can see the shared picture if he loads the url directly. So facebook is "save" for this exploit, but should restricted photos be public available?