Top all-time · #4882
Broken Browser
Personal blog · brokenbrowser.comsecurityweb
Broken Browser is a personal blog at brokenbrowser.com about security and web. Since 2016, 15 different Hacker News readers have linked it 18 times, most often “Referrer spoofing with iframe injection (IE)”. No feed was found, so read it on the site itself.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Broken Browser for reports of browser security flaws, mainly Edge referrer-spoofing bugs, which commenters tie to CSRF defences and to choosing a browser.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Fun with browser vulnerabilities
Most-linked posts?
- Referrer spoofing with iframe injection (IE)3 people · 3 mentions · first linked 2017-03-24
- Abusing Protocols to Load Local Files, Bypass the HTML5 Sandbox, Open Popups3 people · 3 mentions · first linked 2016-11-26
What Hacker News says?
I used to prefer the origin/referer approach to blocking CSRF because it can be done upstream of the application server (or in a middleware), transparent to developers who often get these things wrong. However there's been enough referer spoofing browser bugs lately that I'd rather have the extra safety (and complexity) of CSRF tokens. Just 3 months ago Edge had (another) referer spoofing bug: https://www.brokenbrow…
Comment linking /referer-spoofing-patch-bypass/
on “Securing your API: a modern alternative to CSRF tokens”Submitted Abusing Protocols to Load Local Files, Bypass the HTML5 Sandbox, Open Popups as a story · 323 points
HN discussionEdge is not a good browser. It is holding the web back with its slow adoption of HTML5 standards. (source: https://html5test.com/compare/browser/chrome-58/edge-12.html ) Edge still has a spoof referrer header vulnerability that's been known for more than 6 months now: https://www.brokenbrowser.com/referer-spoofing-patch-bypass/
Comment linking /referer-spoofing-patch-bypass/
on “Announcing Microsoft Edge for iOS and Android, Microsoft Launcher”Submitted Revealing the content of the address bar in IE as a story · 46 points
HN discussionYes, this exactly. If anyone cared to check out the advanced configuration it is pretty much exclusively turning off security vulnerabilities. One of them is "Automatically trust WiFi connections my contacts trust", a bunch of others are sending data to Microsoft. It's been a few months since I turned on a new Windows 10 PC but I was completely turned off by the advanced configuration. The #3 story on HN right now i…
Comment linking /abusing-of-protocols/
on “When Free Software Isn't (Practically) Superior”Submitted Spoofing the Address Bar with the Malware Warning as a story · 5 points
HN discussionSubmitted Abuse Protocols to Load Files, Bypass the HTML5 Sandbox, Open Popups and More as a story · 5 points
HN discussionSubmitted SOP Bypass / UXSS – Stealing Credentials Pretty Fast (Edge) as a story · 2 points
HN discussionSubmitted SOP Bypass / UXSS – Stealing Credentials Pretty Fast (Edge) as a story · 2 points
HN discussionSubmitted Bypassing the patch to continue spoofing the address bar and the Malware Warning as a story · 2 points
HN discussionSubmitted The Attack of the Alerts and the Zombie Script as a story · 2 points
HN discussionSubmitted SOP Bypass / UXSS – Tweeting Like Charles Darwin (Edge) as a story · 1 points
HN discussionSubmitted Edge – SOP bypass courtesy of the reading mode as a story · 1 points
HN discussionSubmitted Referrer spoofing with iframe injection (IE) as a story · 1 points
HN discussionSubmitted UXSS/SOP bypass on Internet Explorer as a story · 1 points
HN discussionSubmitted UXSS – CrossDomain in Microsoft Edge as a story · 1 points
HN discussionSubmitted Spoofing the Address Bar with the Malware Warning as a story · 1 points
HN discussionSubmitted Detecting analysts before installing malware as a story · 1 points
HN discussion
