Top all-time · #24382
Mathias Karlsson
Personal blog · avlidienbrunn.sesecurityweb
Mathias Karlsson writes Mathias {{2*2}}Karlsson, a personal blog at avlidienbrunn.se about security and web. Since 2014, 3 different Hacker News readers have linked it 3 times. No feed was found, so read it on the site itself.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for a write-up of a LastPass autofill exploit, where a crafted URL tricks the extension into filling credentials for another site. Commenters work through the technique and debate whether it is a real vulnerability.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
What Hacker News says?
Does someone understand the snippet? var fixedURL = URL.match(/^(.*:\/\/[^\/]+\/.*)@/); fixedURL && (url = url.substring(0, fixedURL[1].length) + url.substring(fixedURL[1].length).replace(/@/g, "%40")); It looks like: * fidexURL is whatever is after :// and up until the very last @ (greediness) * the second line fixedURL && is going to complete if fixedURL is not undefined * url = this fixedURL, then the rest of it…
Comment linking /@twitter.com/@hehe.php
on “LastPass autofill exploit”Submitted Bypassing AngularJS Sandbox and winning a $5,000 Google bug bounty as a story · 5 points
HN discussionI don't quite follow. The author says that by entering the URL " http://avlidienbrunn.se/@twitter.com/@hehe.php" , the extension is fooled into autofilling as if the browser was on twitter.com. What's the difference with simply going to " http://twitter.com" ? This looks more like a bug than a vulnerability, what am I missing?
Comment linking /@twitter.com/@hehe.php%22
on “LastPass autofill exploit”