Looking at how many sites use vulnerable JavaScript libraries • Hacker News Board

Re: Looking at how many sites use vulnerable JavaScript libraries

#51

Post by jacquesm » Thu, Nov 23, 2017, 10:23 AM UTC

nicksantamaria wrote: post #50

jacquesm wrote: post #42

Earlier quoted context omitted.

That's not always what is going on. In some cases unscrupulous operators will run through large numbers of $1 transactions in order to lower their chargeback rate.

This sounds interesting - can you explain further?

Chargebacks have a cap, if you go over that cap you get fined or lose your merchant account. So in order to dilute the pool they'll make a lot of low $ amount charges usually masquerading as some charity, those will have very low charge back rates so the average charge back %age will drop.

Re: Looking at how many sites use vulnerable JavaScript libraries

#52

Post by zaarn » Thu, Nov 23, 2017, 1:17 PM UTC

bastawhiz wrote: post #9

merb wrote: post #7

> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.

An XSS issue could make your users' data vulnerable.

Your backend should be double-checking any escaping the frontend does.

Otherwise you can throw your fancy anti-XSS on the frontend in the bin.

Also CSP helps.

Re: Looking at how many sites use vulnerable JavaScript libraries

#53

Post by will4274 » Thu, Nov 23, 2017, 7:22 PM UTC

merb wrote: post #7

> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.

> No Front-End JS Library should actually make your backend vulnerable.

FUD. Most SPAs keep the authentication token accessible to JavaScript so it can be sent to the API server. And XSS in the FE JS can permit an attacker to steal the user's authentication token and then the attacker could impersonate the user and take any action as the user.