News for hackers. Stuff that matters.

A comment on LeakyX, a vulnerability that Apple and Microsoft have known about for years. Parent comment

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by creator_lol on Saturday September 23, 2017 @05:49PM (#15321948)
> And just how would the client do that? Using an (easily spoofable) "Server:" header in the HTTP response?

umm , yes?? Even a simple check would increase the complexity a successful attack. Yes it could be duplicated , but having a client that just dumps the credential without any verification does not sound like a good idea and is poor programming.

[ Parent | on HN ]
Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by tomsmeding on Saturday September 23, 2017 @06:01PM (#15322007)
Including some fixed piece text in a server response is not complex. It does not increase the security of the system.
[ Parent | on HN ]