Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

#1 CSRF Is A Vulnerability In All Browsers

homakov.blogspot.com

Post reply on HN
Print view View original

21–30 of 256 posts

Re: #1 CSRF Is A Vulnerability In All Browsers

#21

Post by seanp2k2 »

rosser wrote: post #5
akavlie wrote: post #2

For those who didn't see the recent kerfuffle: This guy recently found and demonstrated a major Rails exploit on github. He seems to know a thing or two about security exploits.

Clarification: he didn't recently find the exploit. He's been making noises about it for a very long time and being ignored, so he took the (dubious, to some) step of using the exploit publicly and loudly, to draw attention to the problem.

And we all saw what happened: Github got in gear real quick and rolled out a fix FAST.

Point, dood.

Re: #1 CSRF Is A Vulnerability In All Browsers

#22

Post by tlogan »

I 100% agree - CSRF is a huge hack: basically telling programes to add CSRF to all their forms and requests shows that all these cookies and security measures in browsers are worth shit. It seems like the entire web security needs to be redesigned from scratch.

Re: #1 CSRF Is A Vulnerability In All Browsers

#23

Post by homakov »

epimenov wrote: post #16
spamizbad wrote: post #10

I'm having a little trouble parsing this post. Is he saying he's discovered a variant of CSRF that cannot be stopped by using the Synchronizer Token Pattern? Or has he found something that a lot of site's protection patterns don't follow?

he discovered that you can log out from google via a GET request (surprise!)

lol it's just funny trick 4 lulz. It has nothing to do with future stuff

Re: #1 CSRF Is A Vulnerability In All Browsers

#25

Post by davepeck »

My app's web site is built with Django. I use the built-in CSRF tools. (I should emphasize that my site is strictly HTTPS.)

In theory, no normal user will ever fail CSRF checks. In practice, tons of people have complained that they see Django's (very confusing) CSRF error page when they try to sign up for my service.

This was surprising to me; I thought we were _way_ past this point. Digging into it, I've learned that tons of people use extensions that muck about with cookies in ways that break Django's CSRF feature. I don't really know a way around it.

How common is this, in your experience?

Re: #1 CSRF Is A Vulnerability In All Browsers

#26

Post by seanalltogether »

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well?

https://mail.google.com/mail/u/0/?logout

Re: #1 CSRF Is A Vulnerability In All Browsers

#30

Post by homakov »

davepeck wrote: post #25

My app's web site is built with Django. I use the built-in CSRF tools. (I should emphasize that my site is strictly HTTPS.) In theory, no normal user will ever fail CSRF checks. In practice, tons of people have complained that they see Django's (very confusing) CSRF error page when they try to sign up for my service. This was surprising to me; I thought we were _way_ past this point. Digging into it, I've learned tha…

I've been examining django sites either. confirm
Post reply on HN