Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just learn about tabnabbing.

Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating those sites and convincing the user that the site is genuine. [...] The exploit employs scripts to rewrite a page of average interest with an impersonation of a well-known website, when left unattended for some time.

It is mentionned that you can detect to which website a user is currently logged in.

How would you proceed to detect is logged in Facebook from another site for example?

share|improve this question

1 Answer 1

There is no universal standard about what "being logged in" actually means, so there is no universally applicable solution.

Depending on the website, the attacker could use a javascript which attempts to load an image or other media file from the external website which can only be requested by a user which is logged in. When the user is logged in, the load event will be triggered, otherwise the error event will be triggered.

share|improve this answer
1  
Unless hosted under the same domain, the SOP will scratch this. –  marstato Jul 3 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.