News for hackers. Stuff that matters.

A comment on Why TLS 1.3 isn't in browsers yet. Parent comment

Re:Why TLS 1.3 isn't in browsers yet by slrz on Wednesday December 27, 2017 @05:35PM (#16018659)
How would that interact with the Same-Origin Policy?
[ Parent | on HN ]
Re:Why TLS 1.3 isn't in browsers yet by kevincox on Wednesday December 27, 2017 @05:59PM (#16018815)
Since you wouldn't have access to cookies I don't think it would be the end of the world. However you would have access to the users LAN which would likely make many local devices' vulnerabilities exploitable. All in all it is probably a bad idea with the current state of IoT, home routers, printers...
[ Parent | on HN ]
Re:Why TLS 1.3 isn't in browsers yet by Spivak on Wednesday December 27, 2017 @07:09PM (#16019251)
Giving a web page access to any part of the user's environment not explicitly given to is malicious data exfiltration waiting to happen.
[ Parent | on HN ]