121–130 of 174 posts
Another thing people don't realize is that if your browser/extension prefills/autofills certain fields (say, name, email, address, etc), those things can be easily sent to the website even if you don't press the submit button. https://www.theguardian.com/technology/2017/jan/10/browser-a...
Perhaps it's time for more granular Javascript blocking. Since forever it's been 'Enable Javascript yes / no'. This makes no real world sense to me anymore (if it ever did). Could there be an end-user friendly way to tell a browser to block Javascript that transmits your 'pre-submit' activity on a web site without breaking the site?
No (imo). It'll be impossible to tell that apart from legitimate usage. JS can access the input fields, garble them, and send to the server. How would you tell that apart from say, a ticker request to update real-time prices?
Another thing people don't realize is that if your browser/extension prefills/autofills certain fields (say, name, email, address, etc), those things can be easily sent to the website even if you don't press the submit button. https://www.theguardian.com/technology/2017/jan/10/browser-a...
It's amazing this still works in Chrome. Open https://anttiviljami.github.io/browser-autofill-phishing/ , enter some auto-fill info, click "Submit" and monitor your "Network" tab requests. You'll find your browser leaked way more info than those 2 information...
The browser was submitting the form with auto-fill details that failed the validation checks for those fields. Hard to show an error message for fields the user can't see.
Yes, it is more robust to have code on the server side discard input that isn't expected rather than validate it, but it annoying extra work when those fields have no security impact.
The alternative is to tell the browser not to auto-fill those fields, but doing that feels broken too.
Earlier quoted context omitted.
TLS has very little to do with it. Some intermediary parties may be able to read the plaintext, but that's different from putting it on pastebin for everyone to see. I've never heard of ISPs or transit providers publishing privacy-sensitive data or otherwise snooping on it. (Assuming non-business / non-VPN / non-proxy connections. Just an ordinary internet connection.) The author probably meant if the site gets/is ha…
Many high-profile commercial carriers will do deep packet inspection of the traffic from their end users, so that they can do insertion of their own ads into whatever content you may be surfing. Including on your webmail pages. And their ad networks might well be infected with malware. But because of deep packet inspection and editing, you can't tell that the malvertising in question actually came from AT&T or Spectr…
I'm sure Google would not be happy with content injection into gmail.
Earlier quoted context omitted.
I don't think anyone is surprised, but it is still good to call out bad actors from time to time. Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.
>I don't think anyone is surprised I do. Nobody who goes on HN will be. But the layman who spends 80 hours a week working a minimum wage job who has no time for computers and just wants a Disney vacation for his kids, absolutely would be floored by this. It seems very reasonable to apply conventional logic to computers. You can write all you want on a piece of paper and then throw it away and nobody would see it. The…
Earlier quoted context omitted.
Is there a way to change Firefox's behavior for passwords so that I need to click to fill them in? I couldn't find anything in a quick Google search.
Password should be saved per-site. Like, I think they actually are.
Firefox seems to save passwords per domain name. This may not be specific enough in certain cases. E.g., if I have a password on domain.com, but domain.com offers web hosting at domain.com/username, then my understanding is it would be relatively easy to obtain my credentials for domain.com with the right phishing site at domain.com/username. Correct me if I'm wrong.
Earlier quoted context omitted.
I don't think anyone is surprised, but it is still good to call out bad actors from time to time. Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.
It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff including intercom, segment, etc.