31–35 of 35 posts
Wow, this is ridiculous: http://www2.telesign.com/login.php?loginerror=yes&user=\... Pathetic. (Telesign is behind StrongWebmail)
I verified that the latest version of Chrome and Firefox doesn't prevent the XSS attack.
Wow, this is ridiculous: http://www2.telesign.com/login.php?loginerror=yes&user=\... Pathetic. (Telesign is behind StrongWebmail)
Wow, this is ridiculous: http://www2.telesign.com/login.php?loginerror=yes&user=\... Pathetic. (Telesign is behind StrongWebmail)
IE 8 notices the XSS attack and tries to safeguard the user. http://imgur.com/FzN1f.png I verified that the latest version of Chrome and Firefox doesn't prevent the XSS attack.
glad to see the advertising program on HN working as planned
Advertising that their application is incredibly insecure? Even if they fix this, I wouldn't trust a company that claims their product is very secure, offers a $10k reward for hacking it, then gets exploited in less than a day by (most likely) the simple XSS vulnerability mentioned in another comment.
No, weegee is referring to this story which was deleted as spam apparently:
Earlier quoted context omitted.
Can you explain what the CSRF attack you're thinking of is? Maybe I'm not reading you carefully enough (long day), but that doesn't sound like a CSRF to me.
Well my thoughts were something like: Victim logs in using two-factor auth, gets a cookie which lets them back in without phone in future. Attacker sends email to victim with some kind of script embedded. Victim views email, javascript runs and sends cookie info to attacker. Attacker uses cookie to impersonate victim. Of course, it's been a long day here too, and I'm so far from an expert on this stuff it's entirely…
That said they say they also needed a strongwebmail account for it to work so I could be wrong - perhaps they just hijacked their authed session ID into the ceo's (possibly??)
