Harvesting credit card numbers and passwords from websites
1–10 of 128 posts
Re: Harvesting credit card numbers and passwords from websites
#2Yeah, and Call Manager has a bug that lets incoming callers transfer themselves to intercom. Keep an eye on that Cisco phone on your doctor's desk while he discusses your HIV test results with you. I could be recording it.
Re: Harvesting credit card numbers and passwords from websites
#3The best part is when you get caught, you can just play dumb and say your npm credentials were compromised (assuming precautions were taken in not using a collection domain tied to you).
Re: Harvesting credit card numbers and passwords from websites
#4So it seems developers are in fact responsible for dependencies that they use... Who would've thought...
Re: Harvesting credit card numbers and passwords from websites
#5The best part is when you get caught, you can just play dumb and say your npm credentials were compromised (assuming precautions were taken in not using a collection domain tied to you).
[deleted]
Re: Harvesting credit card numbers and passwords from websites
#6The author mentions that Chrome Extensions are a bad distribution method. I think he is wrong. First, there are more users of Chrome Extensions than the users of npm, second, most of them don't care what those extensions send over the network. And I guess CSP doesn't apply to browser extensions.
So if you want to steal passwords, make some extension like "Mp3 Youtube Downloader" or "Ad Blocker" and get access to millions of happy users' browsers.
CSP looks like an ugly hack rather than a good solution. Why would you need to specify allowed sources for scripts if you control your HTML code? I don't understand why the author praises it. What a stupid time-wasting technology.
Re: Harvesting credit card numbers and passwords from websites
#7The author mentions that Chrome Extensions are a bad distribution method. I think he is wrong. First, there are more users of Chrome Extensions than the users of npm, second, most of them don't care what those extensions send over the network. And I guess CSP doesn't apply to browser extensions. So if you want to steal passwords, make some extension like "Mp3 Youtube Downloader" or "Ad Blocker" and get access to mill…
you dont always control your html due to XSS and CSRF.
Re: Harvesting credit card numbers and passwords from websites
#8The author mentions that Chrome Extensions are a bad distribution method. I think he is wrong. First, there are more users of Chrome Extensions than the users of npm, second, most of them don't care what those extensions send over the network. And I guess CSP doesn't apply to browser extensions. So if you want to steal passwords, make some extension like "Mp3 Youtube Downloader" or "Ad Blocker" and get access to mill…
> CSP look like an ugly hack rather than a good solution ... I don’t understand why the author praises it.
Because it appears to be the ONLY solution to the problem described, unless you never use any third party code that you didn’t build from source and audit.
Re: Harvesting credit card numbers and passwords from websites
#9So it seems developers are in fact responsible for dependencies that they use... Who would've thought...
I was going to say the following:
Except that being responsible for your dependencies (and the dependencies of your dependencies...) is impossibly hard. You would need to build everything yourself after auditing the code.
You still need to get the source for all your dependencies and all of their dependencies and so on and build it yourself, but you should probably do that anyway and host the artifacts in your own private repo. That’s good practice and avoids issues like the left-pad thing.
Re: Harvesting credit card numbers and passwords from websites
#10What could be the npm package the author of this article is referring to?