News for hackers. Stuff that matters.
Re:Show HN: Print a WiFi Login Card by city41 on Monday July 12, 2021 @09:25AM (#27809979)
You can still hide the data in "folders". /foo/bar/baz/buz can be totally dynamic on the server.
Re:Show HN: Print a WiFi Login Card by ericfrederich on Monday July 12, 2021 @09:44AM (#27810170)
How about after load, that tab automatically goes completely offline. Users can manually do this in Chrome on a tab by tab basis by using developer console and setting Throttling to "Offline"
Re:Show HN: Print a WiFi Login Card by city41 on Monday July 12, 2021 @09:57AM (#27810321)
That sounds more promising. The site might be able to store data and then send it the next time the page is loaded. I think at the end of the day, a malicious dev could probably find a workaround to most implementations. Might just be better to vet out sites and use reputation to state they are truly offline.
Re:Show HN: Print a WiFi Login Card by ericfrederich on Monday July 12, 2021 @08:14PM (#27816517)
I hear what you're saying, but I also believe this to be a solvable problem
Re:Show HN: Print a WiFi Login Card by richthegeek on Monday July 12, 2021 @09:52AM (#27810253)
Note that the "offline" mode in devtools doesn't kill any websocket connections. It may have other holes i'm not aware of also.
Re:Show HN: Print a WiFi Login Card by codethief on Monday July 12, 2021 @03:23PM (#27813952)
Or in the subdomain, using "DNS exfiltration": https://twitter.com/rsobers/status/1293539543115862016
Re:Show HN: Print a WiFi Login Card by city41 on Tuesday July 13, 2021 @10:12AM (#27821223)
That's an interesting exploit, thanks for sharing.