3 ms·
My twitter stream is now full of people, some of whom I am sure do not have the skill to evaluate if something is a JavaScript security threat or not, who have
by po 12y ago
My twitter stream is now full of people, some of whom I am sure do not have the skill to evaluate if something is a JavaScript security threat or not, who have copied and pasted a random script they read on the internet into the developer console. Granted, this one is pretty simple and easier to evaluate than most, but still… you really get why Facebook hacked the console to warn people not to do that.
edit: This tweet said exactly what I was thinking when I saw all of this. https://twitter.com/s_m_i/status/493609377958723584 https://twitter.com/s_m_i/status/493609377958723584
"Also this uber thing shows folks will copy and paste commands they don’t understand without a second thought if the incentives are right"
- peterwwillis 12y agoIt's just phishing via web console. You can convince humans to do just about anything for the right incentive.
- brador 12y agoWhat's the worst that could happen?
- troels 12y agoXSS?
- untog 12y agoOrdering an expensive car ride, presumably.
- joshfraser 12y agoGrabs your account information and sends it along to the hacker.
- chadillac 12y agoYikes... >window.Uber.pingData.client.paymentProfiles [ Object cardExpiration: "2014-03-01T00:00:00+00:00" cardExpirationEpoch: 1393632000000 cardNumber: "[last 4]" cardType: "MasterCard" id: [payment id] useCase: "personal" uuid: "[uuid of payment option from their system]" __proto__: Object , Object accountName: "[acct number]" billingCountryIso2: "US" billingZip: "[billing zip]" cardExpiration: "2017-09-01T00:00:00+00:00" cardExpirationEpoch: 1504224000000 cardNumber: "[last 4]" cardType: "Visa" id: [payment id] tokenType: "braintree" useCase: "personal" uuid: "[uuid of payment option from their system]" __proto__: Object ]