Comments on Security: Cross-domain search timing

How can i add my phone number to my facebookaccoun...

2020-03-04T14:30:54.036-08:00

How can i add my phone number to my facebookaccount

oh this new way for security my site. My site hav...

2013-07-17T01:11:29.961-07:00

oh this new way for security my site.
My site have just down for DDOs.
I will reviewed code again.

Cool heart, and shot on the mercy Dragonica Gold o...

2010-02-12T23:40:57.394-08:00

Cool heart, and shot on the mercy Dragonica Gold of, Ling Po crazy way to EVE Isk kill, he began to love the taste of blood, like to see these cowardly FFXI GIL monsters in front of him like the poor, like the thrill of the muscles across the Bing Ren ... ...

He entered the 49th floor, the Lineage 2 Adena iron front of the room was familiar. The middle of the Last Chaos Gold room there is an old man sitting there, is close their eyes meditatively. It Knight Online Gold seemed that the advent of Ivy Ling Po do not know.

Ivy Ling Po stood there quietly, he Flyff Penya has felt the old man out of a strong body radiates a gas, he stared at the old man: "When I first arrived someone asked EQ2 Gold me to defeat the forty-nine-story monster, now left This last layer of the, no one thought was a powerful human masters, could I then, he 2Moons Dil takes a fight? "Ivy Ling Po Zi Cun," Although I experienced 48 times the fighting, but also learn many new moves can be With my present strength, but also far behind him, it appears was a World War II had.
un

@sdc Your example doesn't seem to work in Oper...

2010-01-21T05:15:41.464-08:00

@sdc Your example doesn't seem to work in Opera.

@sdc: re: your PoC and my comment "Since both...

2009-12-29T23:52:58.697-08:00

@sdc: re: your PoC and my comment "Since both seem to rely on loading non-CSS content cross-domain, note that this can and will be fixed in the browsers." - see http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html :D

@sdc: I like the simple elegance of your example! ...

2009-12-14T12:00:31.481-08:00

@sdc: I like the simple elegance of your example!
It looks like my more complicated MySpace example:
http://scarybeastsecurity.blogspot.com/2008/08/cross-domain-leaks-of-site-logins.html
Since both seem to rely on loading non-CSS content cross-domain, note that this can and will be fixed in the browsers.
In the case where valid CSS changes (or appears) upon authentication, not really much can be done though :-/

poc! http://eaea.sirdarckcat.net/ingoogle.html

2009-12-12T06:30:20.174-08:00

poc!
http://eaea.sirdarckcat.net/ingoogle.html

actually, you can also do something like < link...

2009-12-12T06:29:59.678-08:00

actually, you can also do something like < link rel=stylesheet src=https://www.google.com/accounts/ManageAccount >
< div class=cleafix > you are logged in on google < /div >

timing is too messy, CSS is cooler! :) works on ie/chrome/firefox/etc..

Hi Chris.. You can also check out "Its all ab...

2009-12-11T23:56:11.732-08:00

Hi Chris.. You can also check out "Its all about the timing", our vegas 2007 presentation: http://www.sensepost.com/research/squeeza/dc-15-meer_and_slaviero-WP.pdf

There is video online too, but the paper should cover *