Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

#1 CSRF Is A Vulnerability In All Browsers

homakov.blogspot.com

Post reply on HN
Print view View original

11–20 of 256 posts

Re: #1 CSRF Is A Vulnerability In All Browsers

#11

Post by spicyj »

homakov wrote: post #8
elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

hm yep. should I hide that thing? hm.. Sorry guys in advance.

It'd be nicer if you had a link to a separate page that does it so that people can read the post first.

Re: #1 CSRF Is A Vulnerability In All Browsers

#12

Post by homakov »

spamizbad wrote: post #10

I'm having a little trouble parsing this post. Is he saying he's discovered a variant of CSRF that cannot be stopped by using the Synchronizer Token Pattern? Or has he found something that a lot of site's protection patterns don't follow?

nope. Token Pattern is ugly workaround browsers' vulnerability - that's the point.

Re: #1 CSRF Is A Vulnerability In All Browsers

#13

Post by olex »

homakov wrote: post #8
elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

hm yep. should I hide that thing? hm.. Sorry guys in advance.

You could make it into a button: "Log me out of Google" or something like that. That way, you can still demonstrate it's easily done, but only people who are interested will see it.

Re: #1 CSRF Is A Vulnerability In All Browsers

#16

Post by epimenov »

spamizbad wrote: post #10

I'm having a little trouble parsing this post. Is he saying he's discovered a variant of CSRF that cannot be stopped by using the Synchronizer Token Pattern? Or has he found something that a lot of site's protection patterns don't follow?

he discovered that you can log out from google via a GET request (surprise!)

Re: #1 CSRF Is A Vulnerability In All Browsers

#17

Post by sedictor »

homakov wrote: post #8
elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

hm yep. should I hide that thing? hm.. Sorry guys in advance.

Well, you are jerk

Re: #1 CSRF Is A Vulnerability In All Browsers

#18

Post by spamizbad »

homakov wrote: post #12
spamizbad wrote: post #10

I'm having a little trouble parsing this post. Is he saying he's discovered a variant of CSRF that cannot be stopped by using the Synchronizer Token Pattern? Or has he found something that a lot of site's protection patterns don't follow?

nope. Token Pattern is ugly workaround browsers' vulnerability - that's the point.

You know more about this stuff than me, but I always assumed it was the cost of using the HTTP protocol due to its stateless nature. Even if browsers "fix" this issue, you're still placing a measure of trust in the client by not implementing server-side protections.

Re: #1 CSRF Is A Vulnerability In All Browsers

#19

Post by spindritf »

elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

There's an info now at the top of the post

> To stir up your interest - check any google service e.g. gmail, you are logged out.

Great hook btw. Even more impressively, I have all js on his blog blocked through NoScript and it still worked.

Post reply on HN