cookie stealer
Security and privacy
proof of concept cookie theft demo
SHOW HN2018
7points
18comments
#1,952of 2,155 in 2018
Top 91%of 2018 by points
How HN took it
CuriousMostly questions and neutral comments
0 positive, 3 neutral or asking, 0 mixed, 2 critical, out of 5 comments about the project. Thread score -0.31.
Idea: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
Objections
Browsers do not send cross-origin image-host cookies, so the attack does not steal anything
From 3 comments
Except a browser doesn’t send cookies from one random domain to an “image” hosted on another domain, hence no “theft”. Cross origin cookie rules have been the same for eons.
jsjohnst on HNThe cookies from the image domain are the ones that will be sent, not the ones from the domain that the image is displayed on. Hence, doesn't work unless you can host your php on…
laomona on HNHas anyone looked at the code for this? It’s a joke (whether intended as one or not), it doesn’t really “steal” anything.
jsjohnst on HN
Claimed classroom demo is implausible
From 1 comment
I call bullshit unless this class was 20 years ago.
jsjohnst on HN
Injecting HTML enables far worse attacks than cookie theft
From 1 comment
If you can inject any HTML then you could put a <script src="//yoursite.com/hacks.js"></script> tag in there and make arbitrary requests on the user's computer, fingerprint their…
onion2k on HN
Questions
Does the cookie theft actually work across domains?
From 2 comments
One of the oldest trick in blackhat ?
codegladiator on HNHas anyone looked at the code for this? It’s a joke (whether intended as one or not), it doesn’t really “steal” anything.
jsjohnst on HN