Slashdot Mirror
Abusing HTTP Status Codes To Expose Private Info
An anonymous reader writes "Here's a neat technique for testing if people are logged into other websites. Examples for Facebook, Twitter, GMail and Digg are provided." Like we needed more reasons to use the Chrome incognito function.
The new /. still sucks big time. Yeah. Mod me offtopic, why dontcha.
More likely redundant since everyone knows it already.
It now takes 3-5 seconds to 'preview' a one line text post,
Wow, that's an improvement to before where it would take upwards of 10-20 seconds for the preview to finish.
I doubt that halps against the technique presented in TFA, because it does not depend on Cookies or anything that is blocked in Incognito mode. Basically, they only rely to a HTTP request to the site to be checked, using JavaScript to determine the HTTP status. Thus, disabling JavaScript helps. The Firefox Addon "Request Policy" should, according to the autor of TFA, help, too.
Everyone except those who should fix it, apparently.
Something bad is coming when people are suddenly anxious to tell the truth.
Cross-Site Request Forgery ?
Your login info could be stored in a cookie, in which case his image request will use the cookie info and automatically log you in.
Pray tell, how would one have executed a CSRF attack in 1990?