Google Password Alert could be foiled with just 7 lines of JavaScript Google has been obliged to revise its Password Alert anti-phishing protection just hours after releasing it when security researchers showed how the technology was easily circumvented. Security consultant Paul Moore (@Paul_Reviews) has published a proof-of-concept JavaScript exploit that skirted the defensive technology with …
This is the only solution! Nothing is safe so don't use the web for anything of any importance. Ever.
You can return to your interwebnet activities just as soon as we can develop a properly secured interactive communication system, preferably based on some bastardised offspring of IRC and gopher.
Maybe once that's done we can add some graphics and a bit of scripting to enhance the user experience, possibly the odd advert or two to help cover costs, it will be completely different from what we have now...
It was my understanding that the Chrome extensions could only act within the DOM thus making any approach defeatable in theory. I'm envisaging this fix they've just released changing the id of the element from "browser_warning" to "browser_warning2"!
Now I'm sure that's not the case, but I am interested to know how one could actually get around this. Generate random ids for the DIV? Give the DIV no id at all? What did they actually do to fix this because if it's in the DOM there should be a way to defeat it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
