Timeline for Is browser history an important factor when considering security?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 26, 2018 at 16:09 | comment | added | user2867314 | Any proxies will be logging the credentials too. *note yes TLS inspection would be required for this though. Maybe "any" was a strong word.. | |
| Jan 25, 2018 at 8:51 | vote | accept | Ivan T. | ||
| Jan 24, 2018 at 21:29 | review | Suggested edits | |||
| Jan 24, 2018 at 21:33 | |||||
| Jan 24, 2018 at 19:26 | comment | added | schroeder♦ | @ray, you're right, of course, but I'm trying to limit my answer to things that are easily demonstratable as data leaks. There's a ton more things that could also happen, but they might end up as situational or debatable. | |
| Jan 24, 2018 at 19:23 | comment | added | Ray | @schroeder A lot depends on what exactly is displayed right after they log in. If it was this site, for instance, it would be whatever page you were on when you decided to log in. I also can't help but think that this login method would synergize really well with an XSS vulnerability. In the end, the real reason to do it the safer way is (as it often is) "Why risk it?" | |
| Jan 24, 2018 at 19:15 | comment | added | schroeder♦ | @Ray the OP seems to state that it is sent when logging in, which limits the availability of it being used in a referer header. If it persisted as a means of session control, then sure, but I don't think that's the case here. | |
| Jan 24, 2018 at 19:08 | comment | added | Ray | An important concern raised in the stackoverflow link is that the referer header may include the query string with the credentials. So tech support's assertion that the only way to exploit this flaw is to gain access to the user's browser history is simply false, and getting access to the server isn't necessary either. | |
| Jan 24, 2018 at 16:58 | history | edited | schroeder♦ | CC BY-SA 3.0 |
deleted 9 characters in body
|
| Jan 24, 2018 at 14:57 | history | answered | schroeder♦ | CC BY-SA 3.0 |