Target=“_blank” – the most underestimated vulnerability ever

Re:Target=“_blank” – the most underestimated vulnerability ever by combatentropy on Tuesday December 24, 2019 @06:00PM (#21875518)

> The page we're linking to gains partial access to the linking page via the window.opener object. The newly opened tab can then change the window.opener.location

Dear browsers, please just remove this feature.

[ Parent | on HN ]

Re:Target=“_blank” – the most underestimated vulnerability ever by rasz on Tuesday December 24, 2019 @06:27PM (#21875631)

There might be some legacy code using this, but privacy conscious browsers (so not Chrome, but maybe Vivaldi?) should have a section dedicated to turning off stupid shit like this. Opera used to have plethora of options where you could disable user hostile tricks like blocking right click menu etc. Things you could customize (down to per website granularity):

Allow resizing of windows

Allow moving of windows

Allow raising of windows

Allow lowering of windows

Allow changing of status field

Allow scripts to detect context menu events

Allow script to hide address bar

Enable frames

Enable inline frames

Send referrer information

+ability to disable/set detailed quota/readonly for HTML5 local storage/cookies

Modern browser should probably throw in ability to disable/block AudioContext/ navigator.mediaDevices/ navigator.getUserMedia/ HTMLCanvasElement.prototype.toDataURL/ HTMLCanvasElement.prototype.toBlob/ CanvasRenderingContext2D.prototype.getImageData/ WebRTC/ navigator.sendBeacon/ window.opener

[ Parent | on HN ]