Tag Info

Hot answers tagged

2

In general, you can't. If you want to execute code on a user's machine, nothing whatsoever stops that user from manually doing the very same stuff themselves. You cannot effectively keep something secret from a motivated user and simultaneously run it on their computer; any secret in the app's code is accessible to the user. The solution is that you can't ...


2

This procedure is probably helpful in identifying and blocking a large number of bots, but people that want to steal your data, will customize and randomize as much as possible in order to avoid detection. Then No. This approach isn't the most effective against the more sophisticated scrapers. I've seen scrapers changing entirely their HTTP requests several ...


1

Never evaluate untrusted input as HTML. Even if the DOM is disconnected (i.e. not inserted in the document), evaluation of HTML can still cause XSS. Your specific example can be exploited using event attributes: var userInput = '<img onerror="alert(\'XSS\')" src="bogusurl:">'; $("<i></i>").html(userInput); If you really need to parse ...


1

No, since that would imply that Flash or JavaScript does have access to raw hardware, outside of its sandbox. Think opposite, that if a flash applet or JavaScript applet would have this access, it would be possible to build a keylogging website that remained Active across tabs. If you need to protect against keyloggers, I would suggest some sort of 2FA. ...


1

Presumably it would need to not capture content loaded from other domains (like iframes or images), but that seems solvable. The easiest explanation is that for any feature to exist it has to be prioritized over all of the other features that don't exist. You have to sell it to developers and this seems like it would have privacy implications that would ...



Only top voted, non community-wiki answers of a minimum length are eligible