Board logo

window_injection_vulnerability threat
mangogrooveworkshop - 15/12/04 at 03:41 PM

New scary threat to browsers


PRIVOXY PLUS SQUID SEEMS TO PROTECT AGAINST IT

[Edited on 15-12-04 by mangogrooveworkshop]


Staple balls - 15/12/04 at 04:13 PM

IIRC the easiest "fix" for this security hole is just not to have any other websites open when visting sites like internet banks or suchlike.

basically, don't have any other tabs or browser windows open when using sites that use popups (like the hsbc bank login)


Hellfire - 15/12/04 at 04:38 PM

As with SB - I never have any other window open (knowingly) when doing any secure transactions. Using Firefox reduces the likelyhood of this due to it's very nature of non-conformity and blocking pop-ups.


Staple balls - 15/12/04 at 04:58 PM

Yep, good practice and being sensible is a good place to start, firefox helps in a lot of cases too.


Though i'd like to clarify something as far as Firefox goes too.

Firefox is a funny one really. It's almost certainly less secure than IE in a lot of ways, but firefox used a lot less, therefore exploited a lot less than IE, so far at least.

Remember, you're not safe because you're using Firefox, but you're in less danger. it's like wearing a seatbelt or not.


britishtrident - 15/12/04 at 09:27 PM

The main problem with IE is everything was left open by default and Microsoft (some think for its own purposes) left enormous holes in security.

Netscape/Mozilla and IE came from the same Mosaic roots for a long time Netscape was better than IE but around 1997 a major version change meant Netscape became pretty nasty and unuseable. Firefox and Thunderbird had to undo a lot of the damage before they could carry the Mozilla monster back into the lead.

In the past some of the Firefox and Thunderbird version released have been a litle too raw and some known problems that would be very easy to fix haven't been dealt with.

[Edited on 15/12/04 by britishtrident]

[Edited on 15/12/04 by britishtrident]