Live data from Hacker News

Node.js used to mirror DOM across browsers

screentoaster.com

1–10 of 53 posts

Re: Node.js used to mirror DOM across browsers

#7
post #2

Sounds like a security risk to me. If someone tricks you into starting this they could follow you to other websites and collect data.

Security risk in what? Users not paying attention to the URL bar?

Suppose I send you a link to a page I own. I start this thing on said page and track what you do with the rest of the session on the off-chance that you do something sensitive with it. It's like a single-tab key/screenlogger. Combine this with traditional phishing methods (which already work) and you might get valuable data. It's going to be at least as effective as current phishing methods, with the added advantage of not asking for personal data on the landing page as well (so users don't get scared off).

A similar attack would be to override the back button. You know those sites where the back button takes you to a redirect that takes you to the same page? Take one of those, but on the redirect page save the referring URL. Then when the user hits back, have the redirect page start the session sharing and redirect to the referrer. Sounds plenty dangerous to me.

Re: Node.js used to mirror DOM across browsers

#8
I was thinking through something like this just last night, after reading up on Smalltalk and system images. Are you loading each domain in an iframe? How did you manage to overcome Twitter's clickjacking protection? Using the new sandboxed iframe attribute? High five!

Re: Node.js used to mirror DOM across browsers

#10
I am not prone to melodramatic statements, but seeing this I had the same feeling I had the first time I started using GMail.

It's not necessarily the DOM sharing, which is cool enough. I just think that the emergence of sockets in new browsers is going to bring in the "next level", whatever that ends up being.

Seriously incredible, especially considering the development timeframe.

Post reply on HN