Re:GitHub sued for aiding hacking in Capital One breach
by buzzerbetrayed on Sunday August 04, 2019 @01:23PM
(#20607879)
Is this true? I wasn’t aware that websites could capture your find-in-page searches. I’d be interested to know if they can capture your key events when the find-in-page box has focus. Intuition tells me they can’t, and that it would be outside of the websites “sandbox”. But I can’t say for sure.
[ Parent
| on HN ]
Re:GitHub sued for aiding hacking in Capital One breach
by kadoban on Sunday August 04, 2019 @01:42PM
(#20608013)
At the very least, javascript can tell where you are scrolled to on the page. With minor cleverness that should be enough.
Re:GitHub sued for aiding hacking in Capital One breach
by dantillberg on Wednesday August 07, 2019 @01:43PM
(#20636994)
Indeed, this is what I was thinking.
Re:GitHub sued for aiding hacking in Capital One breach
by throwawaywego on Sunday August 04, 2019 @03:02PM
(#20608557)
In most modern browsers you can't capture this when find-in-page box has focus. Only if you manually select text after searching can you capture it (or, like the other reply stated: capture the scroll distance).
But you could easily disable ctrl+f and throw up your own search box with keypress capture. Not all browsers show the search box outside of the browser viewport, and even for those that do (such as Chrome), you could display a hovering modal inside the viewport, as most users won't remember the exact location of the search box.