Re:CSRF is really dead
by kerkeslager on Saturday September 07, 2019 @09:51PM
(#20908065)
As a user, when I visit a site, I never invited some third party to run their code on my computer, and I certainly don't want some third party making requests to the server on my behalf. So screw websites that depend on this bug.
[ Parent
| on HN ]
Just to clarify, CSRF is when a website you visit makes requests on your behalf to a third party (which you have visited/logged into). The third party is also a "victim" of the attack.
> I never invited some third party to run their code on my computer
This can be achieved by disabling JavaScript (e.g. NoScript extension).
As far as I know, there's no extension that can entirely prevent a website from loading resources from other another domain name. If there is, I imagine it would cause a lot of websites to lack styling, images/videos not loading, etc.
Re:CSRF is really dead
by kerkeslager on Sunday September 08, 2019 @12:34AM
(#20908632)
Yes, I knew this, and I said the wrong thing anyway, and I am sorry. I didn't think through what I was saying clearly.
My intent was more of an "Old Man Yells At Cloud" thing; I was just kvetching because the internet isn't as user-focused as it could be. Calling a bunch of resources from all over the place is a user-hostile behavior, and I'm generally unsympathetic when sites break because browsers narrow the range of user-hostile behaviors they support.