News for hackers. Stuff that matters.

A comment on Chrome address spoofing vulnerability proof-of-concept for HTTPS. Parent comment

Re:Chrome address spoofing vulnerability proof-of-concept fo... by tptacek on Thursday July 02, 2015 @12:28PM (#9819946)
Isn't this a little like suggesting that it's a vulnerability that someone can have a large <img> tag with a GIF of Facebook's login page on it?
[ Parent | on HN ]
Re:Chrome address spoofing vulnerability proof-of-concept fo... by rlidwka on Thursday July 02, 2015 @12:44PM (#9820036)
If facebook allows you to put an arbitrarily large img tag onto any of the pages under its domain (so internal navigation could be hidden under it), then yes it is a valid attack vector.
[ Parent | on HN ]