71–80 of 115 posts
This is the new pop-under. Sites trying to serve as many ads as possible will open links with target=_blank and redirect the old window to an ad.
I'm using Chromium and even the link with `rel=noopener` seems to be able to "hax" the first page. Am I reading it wrong or is `rel=noopener` supposed to protect against this?
Earlier quoted context omitted.
To some extent.. Yes. The attacker can replace the current page with his own phising page. Of course, the hostname part of the url would change, but the user is unlikely to notice that.
Case in point: People still fall for things like `facebook.com.totallynotaphishingsite.com'
It could be worth checking out if you want to avoid experiencing this security issue yourself (but I offer no warranties) or if you want to see if it would break any site you visit if browsers would enable the behavior by default.
Earlier quoted context omitted.
This common with OAuth flows. User clicks "login with x", a popup opens that redirects to an authorization page on x. The user then logs in on x, and gets redirected back to origin that takes the token in the hash fragment, and passes it back to the page the user is trying to login to, via window.opener.
Most of these use postMessage.
Is there a practical reason that a reference to the opener window is given to the opened window? That seems like something we could do without.
Example: Google Slides where one tab has the presentation and another tab has the speaker notes. You want those to be in sync.
> Note that this also works when index.html and malicious.html are on different origins — window.opener.location is accessible across origins! ... Why. Why would anyone (not maliciously) consider this desirable behaviour?