News for hackers. Stuff that matters.

A comment on Is Your Site Leaking Password Reset Links?. Parent comment

Re:Is Your Site Leaking Password Reset Links? by marklgr on Monday October 24, 2016 @10:58AM (#12779363)
Why should we trust any website and execute their JS code on our machine? What about privacy, if they decide they can track us and sell the information to whoever they want? And even if they're "legit", what about the 3rd parties they might trust wrongly?
[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by Biganon on Monday October 24, 2016 @11:53AM (#12779917)
Honest question : what harm could possibly be done by Javascript?
[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by zeveb on Monday October 24, 2016 @12:06PM (#12780053)
Remote code execution for one: https://oreoshake.github.io/xss/rce/bugbounty/2015/09/08/xss...
[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by Crespyl on Monday October 24, 2016 @02:26PM (#12781416)
What's more, rowhammer can be done from js: https://github.com/IAIK/rowhammerjs
[ Parent | on HN ]