TetraBlog - Comments

Jeff Jones: Twitter Clickjacking "Attack"

nospam@example.com (Jeff Jones) — Fri, 13 Feb 2009 13:48:31 -0600

As a followup, twitter has since changed tactics from frame busting to blanking the page if it's detected to be running in frames. It looks like the new fix would be harder to override in JS, though there are possible ways around it via hanging javascript or timing attacks, but it's much better than the frame busting. This clickjacking still works on browsers without javascript!

I would still prefer a server-side method such as "site-specific captcha" for lack of a better term. This would only need to be used in cases of a pre-populated form without valid tokens. Standard tweets and replies could be excepted from it.

Tetraboy: 7 things you didn't know, or want to know, about me.

nospam@example.com (Tetraboy) — Sun, 04 Jan 2009 12:15:17 -0600

I did include "popular" name for a bit of CYA.. I believe I found out about it back around 2001-2002. So while there may have been a name for it, it really wasn't as widely known as it is today.

Chris Shiflett: 7 things you didn't know, or want to know, about me.

nospam@example.com (Chris Shiflett) — Sun, 04 Jan 2009 11:22:30 -0600

CSRF was being talked about over 7 years ago:

http://www.tux.org/~peterw/csrf.txt

It was talked about in php|architect over 5 years ago:

http://shiflett.org/articles/foiling-cross-site-attacks

Are you sure you discovered it before it had a name?

Tetraboy: Arrays are Objects are Functions are Objects?

nospam@example.com (Tetraboy) — Sat, 03 Jan 2009 20:27:59 -0600

Thanks Remi. That post was over a year old. I meant to write a followup saying how I did eventually figure out Javascript, but I never got around to it.

Remi Woler: Arrays are Objects are Functions are Objects?

nospam@example.com (Remi Woler) — Sat, 03 Jan 2009 16:28:55 -0600

Arrays are not objects in javascript. You have simple types, arrays, and objects. The fact that you can access object variables the way you access arrays in PHP doesn't mean it's suddenly an array. For a very clear description on Arrays and JSON (Objects), you might want to check out [url="http://www.hunlock.com/blogs/Mastering_Javascript_Arrays"]hunlock.com[/url]. This site has taught me the differences, and how to work with them, and I still use it every now and then as a quick reference. (Hint: keywords "mastering javascript [arrays|json] brings this site as #1 result in google)