61–70 of 90 posts
Earlier quoted context omitted.
I would indeed not trust any OS that allows you to erase the root filesystem without at least asking for the superuser password :)
Funny that Windows does not even allow Administrator to do it. Ubuntu on other side asks only for user password (sudo) :-)
It's the user password of an admin user. What other password can it possibly ask for? a global su password?
Earlier quoted context omitted.
I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…
Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass this by telling users to copy paste the following code, Control+L, type "javascript:" (chrome strips it when copy-pasting), Control+V, Enter. javascript:alert('hi ' + document.body.innerHTML); If people can be tricked into executing code in the dev console, then…
Earlier quoted context omitted.
I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…
Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass this by telling users to copy paste the following code, Control+L, type "javascript:" (chrome strips it when copy-pasting), Control+V, Enter. javascript:alert('hi ' + document.body.innerHTML); If people can be tricked into executing code in the dev console, then…
edit: Ooops, someone had already made a post to this effect. Sorry.
Earlier quoted context omitted.
If scammers can get people to open the developer console and paste code, they can get them to install the "developer tools extension" and then open the console and paste code. Add all the warnings you want, the scammer will say "see what facebook doesn't want you to see!!!". This has been called the "dancing monkeys problem". People can really be manipulated into doing anything in order to see the dancing monkeys (ev…
https://en.wikipedia.org/wiki/Dancing_pigs Never seen it called "dancing monkeys" - got a cite?
Facebook is violating the user's right to their own software.
Earlier quoted context omitted.
Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass this by telling users to copy paste the following code, Control+L, type "javascript:" (chrome strips it when copy-pasting), Control+V, Enter. javascript:alert('hi ' + document.body.innerHTML); If people can be tricked into executing code in the dev console, then…
That no longer works in newer Firefox (and I think Chrome?). You can turn that back on in about::settings though. edit: Ooops, someone had already made a post to this effect. Sorry.
Earlier quoted context omitted.
Because the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great. I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I t…
So downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?
Earlier quoted context omitted.
If scammers can get people to open the developer console and paste code, they can get them to install the "developer tools extension" and then open the console and paste code. Add all the warnings you want, the scammer will say "see what facebook doesn't want you to see!!!". This has been called the "dancing monkeys problem". People can really be manipulated into doing anything in order to see the dancing monkeys (ev…
https://en.wikipedia.org/wiki/Dancing_pigs Never seen it called "dancing monkeys" - got a cite?