Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Closely related to the Meta question Can Google and Cloudflare find my SE password?
In short the SE login page loads javascript from Google and Cloudfare.
I believe the javascript has full access to the DOM and can trivially find my password.
Please do not tell me "trust them".
I believe the javascript has full access to the DOM and can trivially find my password.
In general: Javascript included with the script tag directly into the page has full access to the DOM, no matter where this Javascript is included from. But Javascript only included in iframe or so does not, it has only access to the DOM of the specific iframe.
I don't want to do an analysis of the current login page (which might also change in the future so that the answer gets stale). But based on above general statement you should be able to analyze, if the current integration of third parties into the login page is a risk or not.
SE login page loads javascript from Google and Cloudfare ... Please do not tell me "trust them".
I'm not sure which browser you are using, but Google Chrome has the majority of the market share. And the browser has way more access to any site you visit with it than a Javascript loaded from a specific site.
Additionally Stackoverflow seems to use a CDN (currently Fastly, not Cloudflare) which is usually the TLS endpoint too. Such a CDN could inject arbitrary things into any website served by the CDN and could this way also do way more harm than a single included Javascript file.
In other words - you need to trust them, even if not for the specific included Javascript files.
Any code can be modified to send data to any unauthorised 3rd party. This is not unique to SE, Google, or Cloudflare. Nor is this a problem with Javascript downloaded from 3rd parties. The problem is never where the script is downloaded from, but where the page sends data. That's what you need to check on.
No, it cannot see your password.
When you try to login on SE using Google authentication, two scenarios are possible (oversimplified):
So SE will not run Javascript on a Google domain, and you never have to enter your Google password on a SE hosted page.
Not speaking about SE, but about every site that allows you to use Google, Facebook, Twitter and others for authentication: be careful to see if you are really on a Google (or Facebook, Twitter) domain before supplying your password. It's trivial to make a page that looks exact like Google authentication page but it's not. You may end up giving away your passwords.
