[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAGUWgD_OwgwKVQ+kxLv00dvDnNC9ZU9gWEarwPjSxg7kxK3rbA@mail.gmail.com>
Date: Mon, 31 Oct 2022 11:16:37 +0200
From: Georgi Guninski <gguninski@...il.com>
To: oss-security@...ts.openwall.com
Subject: Is third party javascript on a login page considered dangerous?
In short, is third party javascript on a login page considered dangerous?
The JS has full access to the DOM of the page and can steal
the username and password, which might be reused on other services,
making it yet another cross site cookie, lol.
In general, the JS persists after login, potentially giving
access to sensitive information.
I believe static analysis can't catch all JS, since one script
may load another script.
Also, the JS might be dynamic, depending on the user.
Experience suggests the main 3rd party JS comes from google
and google do [k]no[w] evil [1]
Examples:
bugzilla.mozilla.org loads from googleanalytics
*.stackexchange.com loads from google and cloudfare.
[1] https://en.wikipedia.org/w/index.php?title=Don%27t_be_evil&oldid=1109436328
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
