21–30 of 37 posts
I don't understand how this is so widespread - If you're using a major web framework, and most of these sites probably are right? isn't CSRF protection built in? are people just turning it off?
Well I already posted it, nobody is interested. Okay :( I guess you should change the title - this on is too shouting. Sorry all that I took your time for considering the problem. I see you are not interested to do/solve anything and my arguments worth nothing.
[deleted]
Warning top bar is only my proposal. You can dislike it - but you cannot dislike the fact that CSRF is dangerous.
And, Please, note. The real problem with CSRF - while we (developers, browsers) are fighting - USERS SUFFER. E.g. they lose money from skrill account. They follow spam subscriptions. ETC. Isn't it awful?
I don't understand how this is so widespread - If you're using a major web framework, and most of these sites probably are right? isn't CSRF protection built in? are people just turning it off?
Earlier quoted context omitted.
[deleted]
penetration testers consistently find holes, websites consistently leave holes - isn't it crazy? I just want you to think in "a new way" and find new solutions! Well, mass assignment problem was fixed directly and easily with 1 commit. This one requires Your ideas. Warning top bar is only my proposal. You can dislike it - but you cannot dislike the fact that CSRF is dangerous. And, Please, note. The real problem with…
I think you're wrong about it being a browser bug, or even that it's amenable to browser fixes. Maybe I'm wrong. But I'm only interested in the engineering discussion, not the morality play.
Earlier quoted context omitted.
penetration testers consistently find holes, websites consistently leave holes - isn't it crazy? I just want you to think in "a new way" and find new solutions! Well, mass assignment problem was fixed directly and easily with 1 commit. This one requires Your ideas. Warning top bar is only my proposal. You can dislike it - but you cannot dislike the fact that CSRF is dangerous. And, Please, note. The real problem with…
That's the real problem with all security bugs. CSRF is among the least of them. CSRF can mostly be fixed mechanically, form by form. XSS can't. You should read Michel Zalewsky's post "Postcards from a post-XSS world". I think you're wrong about it being a browser bug, or even that it's amenable to browser fixes. Maybe I'm wrong. But I'm only interested in the engineering discussion, not the morality play.
I'm either. Yes, those all are just security bugs. Known, sometimes fixed, sometimes reported. But I wont even try to check Alexa Top for XSS - I m pretty sure I won't find anyting. Bugs are different, that's why CSRF seems the most dangerous to me.
I hope he's alerted the websites involved before publicly releasing the vulnerabilities like this. This guy has serious potential, he's obviously very smart, I wouldn't want to see him fall into the "bad" side of internet security. Kudos for finding them, I hope you reported them.
If you read it, you'd know he reported most of them. I'm betting he reported all of them (as he did before).
homakov has just done some damn fine work, and it deserves actual discussion, not dismissal and downvotes.
Honest question: could many of these have been addressed if the browser simply didn't send a cookie along with a post or get to a domain that violated the usual same-origin rules? At a glance, it looks like most of the sites are receiving some kind of account or session information from the browser, with Slideshare being a notable exception (they just flatly Did It Wrong).
Earlier quoted context omitted.
That's the real problem with all security bugs. CSRF is among the least of them. CSRF can mostly be fixed mechanically, form by form. XSS can't. You should read Michel Zalewsky's post "Postcards from a post-XSS world". I think you're wrong about it being a browser bug, or even that it's amenable to browser fixes. Maybe I'm wrong. But I'm only interested in the engineering discussion, not the morality play.
>But I'm only interested in the engineering discussion, not the morality play. I'm either. Yes, those all are just security bugs. Known, sometimes fixed, sometimes reported. But I wont even try to check Alexa Top for XSS - I m pretty sure I won't find anyting. Bugs are different, that's why CSRF seems the most dangerous to me.
I object to the title here. If this is "hacking", then this site really needs to start calling itself "Hacker" News. homakov has just done some damn fine work, and it deserves actual discussion, not dismissal and downvotes. Honest question: could many of these have been addressed if the browser simply didn't send a cookie along with a post or get to a domain that violated the usual same-origin rules? At a glance, it…