News for hackers. Stuff that matters.

A comment on The closest I've ever come to falling for a Gmail phishing attack. Parent comment

Re:The closest I've ever come to falling for a Gmail phishin... by Jarwain on Wednesday January 11, 2017 @10:46AM (#13374718)
Its more the idea of rendering the HTML code in this fashion does not make sense to me. Maybe print the code to the page instead of rendering it. Anything would be better than rendering the code; I can't even come up with a possible use case for that functionality, can you?
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by contravariant on Wednesday January 11, 2017 @10:58AM (#13374824)
You could generate a webpage and link to it without needing to host it somewhere.

At any rate, if you allow a URI scheme that embeds the data in the URI itself it'd be very odd to arbitrarily restrict the valid MIME types. It'd be like forbidding a http URL from linking to a JPEG.

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by Jarwain on Thursday January 12, 2017 @01:36PM (#13384848)
Well in a way you're just offloading the cost of hosting that code/data in that case. Instead of hosting it yourself, the page with the link is hosting that webpage.

Well it wouldn't really be arbitrary, it'd be specifically HTML and/or JS, for security related purposes.

[ Parent | on HN ]