271–280 of 372 posts
Earlier quoted context omitted.
Why Safari? The only sane choice is Firefox.
Vivaldi? I certainty trust the people behind that one.
> By the way, before anyone runs off and yells "Switch to Safari" or something like that, keep in mind that Safari is actually in a worse state and doesn't have detailed cookie and site information at all. It does, but it's split between two places. You can see a list of all sites that have stored data in Preferences > Privacy > Manage Website Data... (no option to view here, just delete). You can also navigate to th…
> You can also navigate to the site in the browser and then view the detailed data The author addresses this point (or has now addressed it) in the addendum to point out an "observer effect" shortcoming: This information can be seen with the web inspector in both Chrome and Safari. Yes, but the crucial difference is that you have to navigate to an individual site in a browser window in order to see the site data in t…
Earlier quoted context omitted.
> You can also navigate to the site in the browser and then view the detailed data The author addresses this point (or has now addressed it) in the addendum to point out an "observer effect" shortcoming: This information can be seen with the web inspector in both Chrome and Safari. Yes, but the crucial difference is that you have to navigate to an individual site in a browser window in order to see the site data in t…
Not trying to defend anyone here, but I wonder if there's a non-nefarious reason for this. Specifically, there have been a lot of changes to cookies lately because malicious actors (malware/adware) figured out how to access the cookie store and infer/determine cookie information from other sites. I suspect that maybe this cookie store is kept in a more secure part of the application and only the cookies relevant to t…
Earlier quoted context omitted.
> You can also navigate to the site in the browser and then view the detailed data The author addresses this point (or has now addressed it) in the addendum to point out an "observer effect" shortcoming: This information can be seen with the web inspector in both Chrome and Safari. Yes, but the crucial difference is that you have to navigate to an individual site in a browser window in order to see the site data in t…
Not trying to defend anyone here, but I wonder if there's a non-nefarious reason for this. Specifically, there have been a lot of changes to cookies lately because malicious actors (malware/adware) figured out how to access the cookie store and infer/determine cookie information from other sites. I suspect that maybe this cookie store is kept in a more secure part of the application and only the cookies relevant to t…
https://www.chromium.org/Home/chromium-security/site-isolati...
Earlier quoted context omitted.
> You can also navigate to the site in the browser and then view the detailed data The author addresses this point (or has now addressed it) in the addendum to point out an "observer effect" shortcoming: This information can be seen with the web inspector in both Chrome and Safari. Yes, but the crucial difference is that you have to navigate to an individual site in a browser window in order to see the site data in t…
Not that I think this has actually been applied by anyone in the wild, but it'd be fun to make a site that take advantage of this You can detect developer tools being open in Chrome pretty reliably, so detect dev tools have been open then "clean up your act" before there's a chance to view anything of note
When discord loads, it copies it out of localstorage into a js var and deletes the localstorage. So if you examine localstorage it will be empty. On page unload it copies it back into localstorage. So if you want to see the value, you have to make sure no discord tabs are open in your browser.
I believe one reason for this is to prevent self-xss. It's hard for a malicious person to write a snippet of js to steal the login cookie now that it's no longer in localstorage. Another reason might be to prevent bots. It's hard for someone to automate a discord account if there's no way to get the account's login cookie.
Firefox Nightly is a pretty good browser imho Also it just so happens that there are extensions that allow you detailed (read: raw and editable) cookie data for each website you visit!
You don't even need extensions, that's available in the stock developer tools. Though you have to be on the site at the time to access it.
... this, despite the fact that all the APIs are there, and internally, FF is essentially a bunch of "chrome extensions" on top of the C++ core. That is, the only thing that was removed was the ability to _load_ extensions.
FYI.
> By the way, before anyone runs off and yells "Switch to Safari" or something like that, keep in mind that Safari is actually in a worse state and doesn't have detailed cookie and site information at all. It does, but it's split between two places. You can see a list of all sites that have stored data in Preferences > Privacy > Manage Website Data... (no option to view here, just delete). You can also navigate to th…
From the blog it sounds like Chrome's will be in a similar state after the update. Just another thing I'll have to navigate to in a tedious manner.
Earlier quoted context omitted.
Not trying to defend anyone here, but I wonder if there's a non-nefarious reason for this. Specifically, there have been a lot of changes to cookies lately because malicious actors (malware/adware) figured out how to access the cookie store and infer/determine cookie information from other sites. I suspect that maybe this cookie store is kept in a more secure part of the application and only the cookies relevant to t…
Let's remain serious. It is entirely within the capability of modern computers to admit a dialogue which would let the user view their cookies without magically exposing them to websites. There is no non-nefarious reason for this.
Earlier quoted context omitted.
Not that I think this has actually been applied by anyone in the wild, but it'd be fun to make a site that take advantage of this You can detect developer tools being open in Chrome pretty reliably, so detect dev tools have been open then "clean up your act" before there's a chance to view anything of note
Discord does this. Try to find the login cookie. When discord loads, it copies it out of localstorage into a js var and deletes the localstorage. So if you examine localstorage it will be empty. On page unload it copies it back into localstorage. So if you want to see the value, you have to make sure no discord tabs are open in your browser. I believe one reason for this is to prevent self-xss. It's hard for a malici…
Like, if I have one Discord tab open (so localstorage is cleared) and I open a second one in parallel, will I be logged out in the second one?