Re:How does Facebook disable Developer Tools?
by joe_hoyle on Wednesday February 12, 2014 @12:16AM
(#7222649)
How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
[ Parent
| on HN ]
Re:How does Facebook disable Developer Tools?
by Strom on Wednesday February 12, 2014 @12:37AM
(#7222703)
Because pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.
Re:How does Facebook disable Developer Tools?
by gkhnarik on Wednesday February 12, 2014 @12:46AM
(#7222743)
I agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.
Re:How does Facebook disable Developer Tools?
by yen223 on Wednesday February 12, 2014 @01:55AM
(#7222976)
See the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.
Re:How does Facebook disable Developer Tools?
by SomeoneWeird on Wednesday February 12, 2014 @02:06AM
(#7223000)
Clever.
Re:How does Facebook disable Developer Tools?
by nbm on Wednesday February 12, 2014 @12:37AM
(#7222708)
Have you tried doing that recently? Doesn't work on Firefox and Chrome, not for some time.
Re:How does Facebook disable Developer Tools?
by azernik on Wednesday February 12, 2014 @12:39AM
(#7222717)
That is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.
Re:How does Facebook disable Developer Tools?
by gkhnarik on Wednesday February 12, 2014 @12:44AM
(#7222734)
And after that Hackers will start telling people do open their Concole in Developer Tools and paste the code there. I believe many people will do.
Re:How does Facebook disable Developer Tools?
by samplonius on Wednesday February 12, 2014 @01:09AM
(#7222817)
But you rapidly reach a point beyond which most users can get to. Three steps: (1) open console, (2) copy, (3) paste is about the limit on what an average computer user can do these days.