Top all-time · #9721
sirdarckcat
Personal blog · sirdarckcat.blogspot.comsecurityweb
sirdarckcat is a personal blog at sirdarckcat.blogspot.com about security and web. Since 2013, 8 different Hacker News readers have linked it 14 times, most often “HTTP Cache Cross-Site Leaks”. No feed was found, so read it on the site itself.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers cite this blog's 2019 post on HTTP cache behaviour and cross-site cache probing to explain how browser cache attacks work, such as detecting whether a resource like Roboto is cached.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- HTTP Cache Cross-Site Leaks6 people · 6 mentions · first linked 2019-03-19
- Unpatched (0day) JQuery Mobile XSS2 people · 2 mentions · first linked 2017-02-09
What Hacker News says?
The attack could still work in some cases, and is as described in the linked post. Your webmail provider has a search box, and the content that is returned is styled with Roboto. If the search finds nothing, then Roboto isn't loaded. The attacker forces Rotobo out of the cache with a specially formatted fetch() request, then loads an iframe of the search. Then the attacker checks if Roboto is in the cache or not. Th…
Comment linking /2019/03/http-cache-cross-site-leaks.html
on “Shared Cache Is Going Away”Submitted Matryoshka: Wrapping Overflow Leak on Frames as a story · 63 points
HN discussionIt's not intended. The fine article prominently links to a page that explains how it works: https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-si...
Comment linking /2019/03/http-cache-cross-site-leaks.html
on “Shared Cache Is Going Away”Submitted Unpatched (0day) JQuery Mobile XSS as a story · 3 points
HN discussionAFAIU you can invalidate the browser cache for a certain resource by hand: > To delete the HTTP Cache, you just have to either issue a POST request to the resource, or use the fetch API with cache: "reload" in a way that returns an error on the server (eg, by setting an overlong HTTP referrer), which will lead to the browser not caching the response, and invalidating the previous cached response. https://sirdarckcat…
Comment linking /2019/03/http-cache-cross-site-leaks.html
on “Python 3.11 in the Web Browser”Submitted HTTP Cache Cross-Site Leaks as a story · 2 points
HN discussionIt was even worse than that: https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-si...
Comment linking /2019/03/http-cache-cross-site-leaks.html
on “Python 3.11 in the Web Browser”Submitted HTTP Cache Cross-Site Leaks as a story · 2 points
HN discussionSubmitted Unpatched (0day) JQuery Mobile XSS as a story · 2 points
HN discussionSubmitted Fighting XSS with Isolated Scripts as a story · 2 points
HN discussionSubmitted Creating a Decentralized Security Rewards Market as a story · 2 points
HN discussionSubmitted How to Bypass CSP Nonces with DOM XSS as a story · 1 points
HN discussionSubmitted Not about the money as a story · 1 points
HN discussionSubmitted JavaScript Apps Timing Attacks as a story · 1 points
HN discussion
