Re: [hybi] workability (or otherwise) of HTTP upgrade

[Bjoern Hoehrmann <[e-mail]>]

* Zhong Yu wrote:
>On Thu, Dec 9, 2010 at 8:06 PM, Bjoern Hoehrmann <[e-mail]> wrote:
>> Consider the simple case of a cookie value "username=x,password=y" (or
>> some other value that remains valid for a long time); if the attacker
>> can inject script but cannot read the secret, the attack will be over
>> as soon as the user closes the browser tab the code is running in. But
>> if he does learn the secret, the attack can last for a long time. Think
>> reading today's mails versus today's mails and tomorrow's. Obviously
>> using cookies this way, much as having script injection vulnerabilities
>> is a security flaw.
>
>You are right. But what if the script pops up a login window, asking
>for username and password?

Well, some might find no reason to log in at this time, others might get
suspicious and close the tab and log in cleanly, for some this might not
be a problem due to the authentification framework employed, and in some
cases people would share their credentials with the attacker. But this'd
be a strictly weaker attack in any case.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/