How does Facebook disable Developer Tools?
stackoverflow.com
How does Facebook disable Developer Tools?
1–10 of 90 posts
Re: How does Facebook disable Developer Tools?
#2I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?
Re: How does Facebook disable Developer Tools?
#3I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?
Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.
Re: How does Facebook disable Developer Tools?
#4I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?
I would imagine that that would only be activated with a full deployment of FB, so developers wouldn't have to worry about it.
Re: How does Facebook disable Developer Tools?
#5I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?
Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.
Because the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great.
I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I teach ruby (on Mac's) I have to start with, "well ok, now download xcode". It's really easy for someone to give up before getting everything working.
Re: How does Facebook disable Developer Tools?
#6How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
Re: How does Facebook disable Developer Tools?
#7There's an interesting link in the accepted answer about how the social engineering hack, that necessitated the disabling of Developer Tools in the first place, was executed in the first place: https://www.facebook.com/photo.php?v=956977232793
Re: How does Facebook disable Developer Tools?
#8How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
Because pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.
Re: How does Facebook disable Developer Tools?
#9How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
Have you tried doing that recently? Doesn't work on Firefox and Chrome, not for some time.
Re: How does Facebook disable Developer Tools?
#10How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
That is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.