News for hackers. Stuff that matters.

A comment on Deviations from Chromium (features we disable or remove). Parent comment

Re:Deviations from Chromium (features we disable or remove) by password4321 on Thursday September 08, 2022 @03:25PM (#32770740)
It's not the link fragment portion of the URL in the address bar that is sent to DNS, it is DNS requests from additional lazily-loaded content that is pulled up when the browser jumps down to it.

Someone else went into detail: https://news.ycombinator.com/item?id=32742504

[ Parent | on HN ]
Re:Deviations from Chromium (features we disable or remove) by illiac786 on Friday September 09, 2022 @01:42AM (#32775704)
This requires the attacker to have third party content on the page you are trying to get the user to scroll through, that is a huge assumption no?

The password web page example is here highly unlikely: if the attacker injected his external content on the password web page, he has already a very strong position - getting users to click on links is not a logical next step, the attacker has far better avenues I would assume.

At least that's my understanding.

[ Parent | on HN ]