Slashdot Mirror
"Lax" Crossdomain Policy Puts Yahoo Mail At Risk
msm1267 writes A researcher disclosed a problem with a loose cross-domain policy for Flash requests on Yahoo Mail that put email message content, contact information and much more at risk. The researcher said the weakness is relatively simple to exploit and puts users at high risk for data loss, identity theft, and more. Yahoo has patched one issue related to a specific .swf file hosted on Yahoo's content delivery network that contained a vulnerability that could give an attacker complete control over Yahoo Mail accounts cross origin. While the patch fixed this specific issue, the larger overall configuration issue remains, meaning that other vulnerable .swf files hosted outside the Yahoo CDN and on another Yahoo subdomain could be manipulated the same way.
I thought Flash was so nearly dead now that all that was left was pronouncement by two qualified physicians. I seriously find it hard to believe that a modern firm like Yahoo would even support it at this point.
Time is what keeps everything from happening all at once.
"Yahoo has patched one issue related to a specific .swf file hosted on Yahoo's content delivery network that contained a vulnerability that could give an attacker complete control over Yahoo Mail accounts cross origin."
As I stated here (and subsequently got modded troll for):
"Maybe people will start taking real responsibility for their sites and content. Passing the buck is lazy and irresponsible, especially in the case of advertising CDNs (and the subsequent malware infestations that spread as a result of them.)"
And lookie what gets reported on.
I love how I get proven right in the face of idiots with mod points.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Well, you need a lax SWF policy to allow the SWFs to swim upstream and spawn.
"We consider that six courts and an asylum claim are a rather odd way of returning to Sweden within a month."
get rid of the flash-based ads and tracking "super cookies"
problem solved.
Of all the email front ends that I have ever used, I have nothing but slowness and crashes from Yahoo no matter what platform I'm on.
Anyone else having this experience?
blindly antisocialist = antisocial
This is why my Yahoo account is my "disposable account" creation SH*TBOX . Way back since 1998
Your position lacks evidence. Flash is without even having a close competitor, the premier multimedia platform on the web.
It still powers YouTube, Vimeo and every major video site. It powers the video feeds of most major, non-mobile news portals. It is pre-installed in Google Chrome. Flash content is being actively created in greater quantities today than 5 years ago. It is viewed by hundreds of millions of people per month. It is the web-based game development platform of choice for a vast majority of game developers, where HTML5 holds a very tiny minority. Every major gaming site relies principally on Flash. The vast majority of sites supporting video games, major Hollywood releases and television shows uses Flash. Every major consulting company, media company, training and distance learning company, university and entertainment company uses Flash.
Keep shrieking "Flash is dead, dude". But your position is frankly ignorant. HTML5 is cool. Very, very cool. But you're like a mosquito biting an elephant and claiming victory.
I live in a world of statistics and facts. You, like a child, live in a world where you believe the things you want to be true.
I'm completely shocked to hear this.
No, wait, I'm not surprised at all. Flash has been a security hole for as long as it has existed.
I don't understand why people let web sites run arbitrary code. Adobe made a horrible platform from a security perspective, and it's been pretty much constantly in the headlines since.
I honestly don't know why people continue to trust the damned thing, and can't believe the sheer number of times I've heard it's been a vector for security holes. Donzens? Hundreds?
Seriously, just stop running the damned thing.
Lost at C:>. Found at C.
Why does Yahoo still exist?
"If any question why we died, Tell them because our fathers lied."
When has yahoo mail ever really been secure? Every couple of years it "Yahoo mail has a security hole because of (insert issue here)".
Marissa Mayer has utterly ruined Yahoo Mail ever since she took charge.
Yahoo Japan Mail was also (eventually) infected by the changes introduced by her.
She's turning Yahoo Mail into a crappier version of Gmail. Mails aren't mails anymore, they're 'conversations'.
Marissa you insufferable wench.
I remember the days when the highest rated comment on Slashdot would be a nice summary of the salient point of the article with some insightful agreement or disagreement.
Came here to say just that. They're too busy redesigning the exteriors and completely fucking it up to notice how crumby and crumbly it really is.