News for hackers. Stuff that matters.
Re:CSS Based Attack fontface by khaled on Monday November 02, 2015 @11:39AM (#10492871)
I don’t see how this would work. When the browser renders an “ff” ligature, it does not do so by converting every “ff” in the input into U+FB00, as such it will never use this font unless the user input actually contains U+FB00 which is unlikely.
Re:CSS Based Attack fontface by jo-han on Monday November 02, 2015 @02:22PM (#10494382)
Khaled, you're right - it doesn't work. The characters are not substituted. I made a quick proof of concept, but it triggered for the wrong reasons. Bummer.