News for hackers. Stuff that matters.

A comment on Blizzard games were vulnerable to DNS rebinding attack. Parent comment

Re:Blizzard games were vulnerable to DNS rebinding attack by geofft on Monday January 22, 2018 @04:50PM (#16208253)
If you want to do that, just do a normal cryptographic signature thing - have the website sign requests with a private key that's kept by Blizzard, and have clients check that requests are signed.

(It sounds like that's not what's happening here because the patch checks for browser EXE names and refuses connections from them, but I'm not quite sure.)

[ Parent | on HN ]
Re:Blizzard games were vulnerable to DNS rebinding attack by blattimwind on Monday January 22, 2018 @05:29PM (#16208632)
No, the much better way to do this is with a custom URI protocol handler, e.g. steam://launch/220, which has no direct interaction between privilege domains (steam and the website).
[ Parent | on HN ]