131–140 of 146 posts
"In all seriousness, this attack vector is pretty slim. You’ve got to tempt unwitting users to visit your site, and to stay on it while they’re developing JS code." Wrap the exploit up in a blog post about Rust -- or an article about gut bacteria -- and submit it to Hackernews. Boom, a virtual feast of secrets.
Could that be the highest voted link in HN history?
"In all seriousness, this attack vector is pretty slim. You’ve got to tempt unwitting users to visit your site, and to stay on it while they’re developing JS code." Wrap the exploit up in a blog post about Rust -- or an article about gut bacteria -- and submit it to Hackernews. Boom, a virtual feast of secrets.
"Gut bacteria influence proficiency at Rust programming." Could that be the highest voted link in HN history?
Earlier quoted context omitted.
Theoretically nothing but it'd probably be a PR disaster even for a site like Facebook if people found out it was trying to steal their passwords. (Is that even legal?)
Technically, you only get legal issues if you do anything bad with the stolen passwords, but it'd totally be a PR disaster so they wouldn't do it anyways.
I too like to hardcode my AWS secret keys in my frontend application
Are there any extensions to block connections to localhost from code on other interfaces or origins?
If you use uBlock Origin, you can prevent any connections to localhost by default.
"you can", or is it blocked by default?
Excuse me, but what in the world? XHR has all kinds of cross-site request protections that even make developing apps locally a pain. How come websockets don't come with such protections?
Are there apps that take over this responsibility?
Node debug mode runs a websocket, but the address is something like ws://0.0.0.0:9229/1cda98c5-9ae8-4f9a-805a-f36d0a8cdbe8 - without the correct guid at the end, you can't open the websocket and communicate. You can only detect the port being open by timing.
This is true, although until recently it was possible to use DNS rebinding to get the list of guids! I actually saw people leaving this enabled so much in shipping products, I wrote a little utility to test for it. https://github.com/taviso/cefdebug
"In all seriousness, this attack vector is pretty slim. You’ve got to tempt unwitting users to visit your site, and to stay on it while they’re developing JS code." Wrap the exploit up in a blog post about Rust -- or an article about gut bacteria -- and submit it to Hackernews. Boom, a virtual feast of secrets.