Top all-time · #3756
Jeremiah Grossman
Personal blog · jeremiahgrossman.blogspot.comsecuritystartups
Jeremiah Grossman's personal blog at jeremiahgrossman.blogspot.com covers security and startups. Since 2008, 20 different Hacker News readers have linked it 22 times, most often “I know your name, where you work, and live (Safari v4 & v5) ”. The last post was in 2024, but the archive is still widely read.
Venture capitalist (Grossman Ventures https://grossman.vc), Internet protector and industry creator. Founded WhiteHat Security & Bit Discovery. BJJ Black Belt.
Most-linked posts?
- /2006/08/i-know-where-youve-been.html6 people · 6 mentions · first linked 2009-04-26
- I know your name, where you work, and live (Safari v4 & v5) 2 people · 2 mentions · first linked 2010-07-22
- /2006/01/advanced-web-attack-techniques-using.html2 people · 2 mentions · first linked 2011-06-18
What Hacker News says?
No. Or rather, there isn't supposed to be. About 8 years ago (see http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo... for an early demonstration) it was possible. This was considered bad, because it could help malicious sites gain information about the browser history which might help with an attack. The browser developers responded by minimizing what a ":visited" can do, so Javascript shouldn't be able…
Comment linking /2006/08/i-know-where-youve-been.html
on “Who am I: A mind reader (don't forget to view source)”Submitted I know your name, where you work, and live (Safari v4 & v5) as a story · 165 points
HN discussionIf I remember correctly, it was first discovered pretty soon after a version of Gecko was introduced with support for setters/getters, and Gecko had minority market share at that time. http://jeremiahgrossman.blogspot.com/2006/01/advanced-web-at...
Comment linking /2006/01/advanced-web-attack-techniques-using.html
on “Why does Google append while(1); in front of their JSON responses?”Submitted Aaron's suicide: System Contributed, Society Perpetuated as a story · 20 points
HN discussionThis attack was used successfully against gmail in Jan 2006. http://jeremiahgrossman.blogspot.com/2006/01/advanced-web-at...
Comment linking /2006/01/advanced-web-attack-techniques-using.html
on “JSON users: Avoid CSRFs by not using top-level arrays”Submitted Written Speech: TEDxMaui -- Hack Yourself First as a story · 6 points
HN discussionTwo major problems come to mind. 1) Breaks password managers and broswers' save password function. Many users are helpless without these. 2) You know how your browser helpfully remembers and fills in your name and address across different websites ? Yeah, now it'll fill in your username and password too, making it accessible via javascript to any site that wants it. Since the password isn't in a password field, the…
Comment linking /2010/07/i-know-who-your-name-where-you-work-and.html
on “Single input login form”Submitted Crossdomain.xml Invites Cross-site Mayhem as a story · 4 points
HN discussionAt least 3 years old: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo...
Comment linking /2006/08/i-know-where-youve-been.html
on “What the Internet knows about you”Submitted Top Ten Web Hacking Techniques of 2010 as a story · 3 points
HN discussionPeople have been using this technique in this way since at least 2006: http://int2e.com/blog/improved-digg-integration-script/ http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo... Since changing browsers to prevent this will not happen tomorrow, this can be partially worked around both server and client-side. Server-side: If you have any sensitive URIs you don't want leaked or brute-forced, add an extra p…
Comment linking /2006/08/i-know-where-youve-been.html
on “Sniff browser history for improved user experience”Submitted Top Ten Web Hacking Techniques of 2008 as a story · 3 points
HN discussionIt was just a matter of time before the CSS history trick was put to use. I can see the benefits, though I don't like the privacy implications. History trick here (JS, no cookies, can poll user's web history): http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo...
Comment linking /2006/08/i-know-where-youve-been.html
on “Sniff browser history for improved user experience”Submitted Our infrastructure -- Assessing Over 2,000 websites as a story · 2 points
HN discussionThe Top-10 is just a start. As a penetration tester and sometimes-trainer, I find it's when developers start to see practical demonstrations of what these vulnerabilities can actually allow a malicious party to achieve that the eyes really get opened. Particularly when those demonstrations are within their own applications. Check out the rest of the OWASP site, and play with WebGoat ( http://www.owasp.org/index.php/…
Comment linking /
on “Top-10 Web Application Security Vulnerabilities (2007)”Submitted Safari giving away personal details as you browse as a story · 2 points
HN discussionThis issue is nine years old at this point and has been published, republished, and blogged countless times. I yearn for the day it stops wasting space on the front page of news aggregators. A partial bibliography: 2000: http://bugzilla.mozilla.org/show_bug.cgi?id=57351 2002: http://seclists.org/bugtraq/2002/Feb/0271.html http://bugzilla.mozilla.org/show_bug.cgi?id=147777 2006: http://portal.acm.org/citation.cfm?id=…
Comment linking /2006/08/i-know-where-youve-been.html
on “Tracking browser behavior without any tools (security breach in most browsers)”Submitted Why website vulnerabilities are not fixed as a story · 2 points
HN discussionboth of you need to be on the internet "more often". It's a CSS history trick at least a few years old. http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo...
Comment linking /2006/08/i-know-where-youve-been.html
on “a thread”Submitted Web Browsers and Opt-In Security as a story · 1 points
HN discussionGreat link! A bit of Googling reveals that this exploit looks like it was authored by Jeremiah Grossman on August 11 2006. http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo... That seems like a very long time for an exploit so obviously useful to stay around...
Comment linking /2006/08/i-know-where-youve-been.html
on “a thread”Submitted Replacing Happiness with Pride (Rugged) as a story · 1 points
HN discussion
