News for hackers. Stuff that matters.
Re:How does Facebook disable Developer Tools? by joe_hoyle on Wednesday February 12, 2014 @12:16AM (#7222649)
How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
Re:How does Facebook disable Developer Tools? by Strom on Wednesday February 12, 2014 @12:37AM (#7222703)
Because pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.
Re:How does Facebook disable Developer Tools? by gkhnarik on Wednesday February 12, 2014 @12:46AM (#7222743)
I agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.
Re:How does Facebook disable Developer Tools? by yen223 on Wednesday February 12, 2014 @01:55AM (#7222976)
See the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.
Re:How does Facebook disable Developer Tools? by SomeoneWeird on Wednesday February 12, 2014 @02:06AM (#7223000)
Clever.
Re:How does Facebook disable Developer Tools? by nbm on Wednesday February 12, 2014 @12:37AM (#7222708)
Have you tried doing that recently? Doesn't work on Firefox and Chrome, not for some time.
Re:How does Facebook disable Developer Tools? by azernik on Wednesday February 12, 2014 @12:39AM (#7222717)
That is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.
Re:How does Facebook disable Developer Tools? by gkhnarik on Wednesday February 12, 2014 @12:44AM (#7222734)
And after that Hackers will start telling people do open their Concole in Developer Tools and paste the code there. I believe many people will do.
Re:How does Facebook disable Developer Tools? by samplonius on Wednesday February 12, 2014 @01:09AM (#7222817)
But you rapidly reach a point beyond which most users can get to. Three steps: (1) open console, (2) copy, (3) paste is about the limit on what an average computer user can do these days.
Re:How does Facebook disable Developer Tools? by jkrems on Wednesday February 12, 2014 @01:24AM (#7222869)
...which is exactly what this post is about..? That's the reason Facebook disables the DevTools console apparently.