phishing

Why do browsers allow onmousedown JS to change href?

徘徊边缘 提交于 2019-12-02 18:38:21
I've noticed for a very long time that when you try to copy a link location or open a link on Facebook, it modifies the link and passes it through l.php . For example, I can be sent to http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.google.com%2F&h=DKVUritNDJDJLDLVbldoDLFKBLOD5dlfDJY_-d3fgDUaA9b even though my browser render the link preview as http://www.google.com/ . Today, I took a closer look using Firebug and found that Facebook puts onmousedown="UntrustedLink.bootstrap($(this)[...] in the <a> tag. The second I right clicked the link, I saw the href attribute change in Firebug. This

How does pushState protect against potential content forgeries?

痞子三分冷 提交于 2019-11-30 18:01:37
As seen in GitHub's blog , they've implemented HTML5's JavaScript pushState feature for tree browsing (for modern browsers), bringing AJAX navigation without Hash Bangs . The code is simple: $('#slider a').click(function() { history.pushState({ path: this.path }, '', this.href) $.get(this.href, function(data) { $('#slider').slideTo(data) }) return false }) This quite elegantly allows them to: Request the just the new content through AJAX instead of a full page Animate the transition And change the browsers URL (not just the # , as Twitter does — twitter.com/stackexchange → twitter.com/#!

How does pushState protect against potential content forgeries?

放肆的年华 提交于 2019-11-30 16:43:14
问题 As seen in GitHub's blog, they've implemented HTML5's JavaScript pushState feature for tree browsing (for modern browsers), bringing AJAX navigation without Hash Bangs. The code is simple: $('#slider a').click(function() { history.pushState({ path: this.path }, '', this.href) $.get(this.href, function(data) { $('#slider').slideTo(data) }) return false }) This quite elegantly allows them to: Request the just the new content through AJAX instead of a full page Animate the transition And change

Should I use the Reply-To header when sending emails as a service to others?

生来就可爱ヽ(ⅴ<●) 提交于 2019-11-27 10:03:09
Suppose we have an application that acts as a middleman, allowing Company A to send reports to their customers. Company A --> Company B (me)--> Company A's customers After getting the report we send email notifications to the recipients, but they necessarily originate from our company notifications email address e.g. joe.bloggs@a.com --> notifications@b.com --> peter@c.com Now, customers tend to reply to those email notifications, wanting them to go back to whoever sent the report at Company A. Instead, they end up back at our address, notifications@b.com. A simple solution may be to change

Should I use the Reply-To header when sending emails as a service to others?

吃可爱长大的小学妹 提交于 2019-11-26 14:59:46
问题 Suppose we have an application that acts as a middleman, allowing Company A to send reports to their customers. Company A --> Company B (me)--> Company A's customers After getting the report we send email notifications to the recipients, but they necessarily originate from our company notifications email address e.g. joe.bloggs@a.com --> notifications@b.com --> peter@c.com Now, customers tend to reply to those email notifications, wanting them to go back to whoever sent the report at Company