News for hackers. Stuff that matters.

A comment on We handled a recent phishing incident that targeted Dropbox. Parent comment

Re:We handled a recent phishing incident that targeted Dropbox by dotBen on Tuesday November 01, 2022 @12:06PM (#33423145)
But it's just as easy to point a DNS record from hr.internal.dropbox.com or techblog.dropbox.com to trusted third party vendors as it is to set up a new domain, but the use of subdomains maintains the security model.
[ Parent | on HN ]
Re:We handled a recent phishing incident that targeted Dropbox by jefftk on Tuesday November 01, 2022 @12:32PM (#33423526)
In the standard way of configuring cookies, allowing third parties to use a subdomain of your domain lets them collect your HTTP_ONLY SECURE cookies and impersonate your users.

The security policy at the FAANG I used to work at required third party vendor code to run on other domains for this reason.

[ Parent | on HN ]