hashtagInsecure

Re:Time to Encrypt the Cloud on Tuesday February 21, 2017 @03:49AM (#13694255)

https://www.schneier.com/blog/archives/2015/05/detecting_qua...

Re:Time to Encrypt the Cloud on Tuesday February 21, 2017 @03:19AM (#13694175)

  We do this by adding a hash character (#) to a link. 
  By design, browsers don’t share anything after this 
  character.

...and I stopped reading there.

It is astonishing to read that. Just absolutely mind blowing.

Browsers absolutely can and DO share things coming after the hash (#) character in a URL. How?

JavaScript! It's absurdly easy to siphon anchor hashes out of the address bar with JavaScript, and send them back to the mothership, or anywhere else for that matter. It's basically how oh-so-many Very Big Websites work.

Are you kidding me?!