News for hackers. Stuff that matters.

A comment on Chrome deploys deep-linking in latest build despite privacy concerns. Parent comment

Re:Chrome deploys deep-linking in latest build despite priva... by liveoneggs on Friday February 21, 2020 @08:39AM (#22382956)
also #fragments aren't sent to the server at all, unless this changes that (a major major change if so)
[ Parent | on HN ]
Re:Chrome deploys deep-linking in latest build despite priva... by amsully on Friday February 21, 2020 @08:58AM (#22383090)
The google document being used talks about crossing an origin-boundary.

So website with bad script injected is loaded by the user and is able to make requests to a logged-in banking website with time-based/scrolling attacks.

[ Parent | on HN ]
Re:Chrome deploys deep-linking in latest build despite priva... by falcolas on Friday February 21, 2020 @12:40PM (#22385000)
Does this matter when the server (well, multiple servers when you throw in ads as well) are running their custom Javascript on the client, which has access to not only the viewport coordinates, but the URL itself?
[ Parent | on HN ]
Re:Chrome deploys deep-linking in latest build despite priva... by liveoneggs on Friday February 21, 2020 @02:34PM (#22386027)
does this add an additional vector to that case?
[ Parent | on HN ]
Re:Chrome deploys deep-linking in latest build despite priva... by tln on Friday February 21, 2020 @08:48AM (#22383016)
Right on. This article is bull
[ Parent | on HN ]