Hashify.me - store entire website content in the URL

Re:Hashify.me - store entire website content in the URL by hashify on Tuesday April 19, 2011 @06:41PM (#2464535)

> That's a feature.

Agreed! One can always link someone to a static HTML page with <script>alert('fu')</script> in the body, but no one would tag that "XSS".

Does hashify.me make it easier to send annoying alert messages to your friends? Sure. Annoying, but no more harmful than sending them to the static equivalent.

[ Parent | on HN ]

Re:Hashify.me - store entire website content in the URL by sweis on Wednesday April 20, 2011 @08:05PM (#2468924)

Fair enough. It's similar to embedding third-party gadgets for things like iGoogle. However, in practice that content is sanitized.

Note there are risks to hosting arbitrary Javascript beyond stealing cookies. For example, you can steal browser history, discover NAT IP addresses, scan intranet ports, etc. Here's a presentation by Jeremiah Grossman covering some of these attacks: http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Gro...

Of course, attackers can host malicious content anywhere they control. I could just as easily send someone a bit.ly link to a malicious site I control.

[ Parent | on HN ]