In retrospect it seems he could have saved himself a Fiddler session if he just opened console debugger in browser and used `?"-(function(){debugger}())-"` in URL instead of `?"-prompt()-"`. (I would not have guessed this either, but may come handy next time.)
How I got XSS’d by my ad network
31–40 of 62 posts
Re: How I got XSS’d by my ad network
#32I've resisted using an ad-blocker for years because I'm happy for the sites I visit daily to earn revenue that way, and for many it's the only way they can. I limited myself to running Privacy badger and blocking Facebook/Twitter tracking cookies, that kinda thing. But this is the straw that's broken my camel's back and it spoils things for those of us who don't mind a few ads here and there. uBlock now installed, so…
Wouldn't it be better to disable third-party scripts?
Re: How I got XSS’d by my ad network
#33Earlier quoted context omitted.
I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains. I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults
I've been called an idiot (even here on HN) for being paranoid about loading scripts from all over the web. I think it's a losing battle and my side is going the way of the dinosaurs.
As tools like uBlock and uMatrix get widespread adoption more and more people are realizing how much extraneous junk is being loaded by webpages. I think your side is slowly but surely gaining followers.
Re: How I got XSS’d by my ad network
#34Earlier quoted context omitted.
I am not that sure of that. Advertisers need to see the connections going through their servers, otherwise they are exposed to massive fraud from the websites they advertise on. So proxy-ing their script might not suit them at all.
So let's do the opposite! Just point our DNS at the ad networks and have them reverse proxy our content! It's genius! (You just know it's gonna happen one day under the guise of a free CDN)
Like Cloudflare does, haha :)
Re: How I got XSS’d by my ad network
#35Earlier quoted context omitted.
With http2, relevant javascript files will be increasingly hosted on the same domain Why is that?
There's a limit on the number of simultaneous requests per domain with http1, which will not be present in http2 [0]. This limit meant that for best performance, static files should be served from multiple (sub)domains. [0] https://mattwilcox.net/web-development/http2-for-front-end-w...
[deleted]
Re: How I got XSS’d by my ad network
#36If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.
On the video, it is mentioned that the advertisements are in a frame.
Is the iframe pointed at a separate domain though? This is crucial to enforce the same origin security within javascript.
Re: How I got XSS’d by my ad network
#37Earlier quoted context omitted.
I wonder how many websites' users would be compromised if code.jquery.com got hacked.
I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains. I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults
> you're also potentially leaking all your visitor stats
Not just potentially but (f)actually!
Re: How I got XSS’d by my ad network
#38This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.
You can setup a Content Security Policy in your web server that will only allow the browser to load scripts from some domains/subdomains.
Re: How I got XSS’d by my ad network
#39"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site" I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acce…
>"they can run anything they like in the context of your site"
Some of them actually depend on that. We seen weird stuff show up on our sites because we made a deal with a company that sells ads for us. Suddenly we're pulling in stuff from companies we never heard of because the ad reseller made a deal with a third-party, which then again outsource part of their infrastructure to a fourth company. It's hours of detective work when you need to figure out who has misconfigured https.
Re: How I got XSS’d by my ad network
#40This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.
Blocking third party JS does not help me offload the libraries to a CDN (ex. cdnjs.com) to save server bandwidth.