CSRF is really dead

Re:CSRF is really dead by olalonde on Saturday September 07, 2019 @11:52PM (#20908507)

Just to clarify, CSRF is when a website you visit makes requests on your behalf to a third party (which you have visited/logged into). The third party is also a "victim" of the attack.

> I never invited some third party to run their code on my computer

This can be achieved by disabling JavaScript (e.g. NoScript extension).

As far as I know, there's no extension that can entirely prevent a website from loading resources from other another domain name. If there is, I imagine it would cause a lot of websites to lack styling, images/videos not loading, etc.

[ Parent | on HN ]

Re:CSRF is really dead by kerkeslager on Sunday September 08, 2019 @12:34AM (#20908632)

Yes, I knew this, and I said the wrong thing anyway, and I am sorry. I didn't think through what I was saying clearly.

My intent was more of an "Old Man Yells At Cloud" thing; I was just kvetching because the internet isn't as user-focused as it could be. Calling a bunch of resources from all over the place is a user-hostile behavior, and I'm generally unsympathetic when sites break because browsers narrow the range of user-hostile behaviors they support.

[ Parent | on HN ]

Re:CSRF is really dead by mehhh on Sunday September 08, 2019 @12:15AM (#20908572)

uMatrix can be used to block 3rd party resources from loading (like Facebook and Google, usually blockable with no ill effects).

[ Parent | on HN ]