41–44 of 44 posts
Earlier quoted context omitted.
How about an extremely slow to render zalgo text, switching between opacity 0 and 1 depending on visited?
Nice idea. I just tried it - looks like alpha is ignored for colors specified in ::visited and the alpha of the non-visited color is always used.
Earlier quoted context omitted.
I think First Party Isolation (available by default in Tor browser and via a about:config flag in Firefox) is this feature?
Exactly. I've used this for over a year now in FF. It can be a bit annoying with things like recaptcha, and sadly some login systems completely break (like Atlassian SSO), but overall most things work just fine.
Atlassian products are garbage for many reasons. But this is literally #1 for me. It's 100% unusable in a securified browser.
Earlier quoted context omitted.
I can give one data point - you have a site that is hosted via static site generator (something like netlify) and users can upload images (that you probably store on S3). Then you provide a service that requires drawing on those images (maybe a map, or heatmap, or some markup tool). Usually you learn that the canvas is tainted and you adjust CORS accordingly. Forcing same-site would require a server side proxy (defea…
Why a server-side proxy, rather than just putting S3 behind the same CDN (which will probably save you bandwidth charges at the same time)?
Earlier quoted context omitted.
reading of cross origin images isn't an attack vector unless credentials were used to request it. Otherwise its no different then doing curl on the attacker's machine.
You're a bit too quick to jump to that conclusion so firmly. There are other cases. Does you company have internal tools exposed via the intranet? If you happen to know the URI scheme, from say an ex-employee, you're able to exfiltrate information if you get a current employee on VPN to open your page. This becomes a tool in a layered attack. Sure it's careless to have such anonymous endpoint on your intranet. But th…