bugtraq - Re: XSS on Yahoo Mail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 27 Nov 2005 15:50:15 -0800
From: Lance James <lancej@...urescience.net>
To: alireza hassani <trueend5@...oo.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: XSS on Yahoo Mail


alireza hassani wrote:

>--- Will Wesley <willwesleyccna@...oo.de> wrote:
>  
>
>>Anyway, a solution is really quite simple.
>>Allow users to disable HTML in their email, or why
>>    
>>
>not by >default? 
>
>Don't you think this is not a real solution?
>User must be safe to use any option and also full
>performances.
>  
>

This HTML stuff should be allowed, but controlled - similar to on blogs.
Unfortunately I have found very bad hole in the compose mail section of
yahoo when HTML is on, but that just means that they should filter
better for HTML features.

>Alireza Hassani (http://www.kapda.ir)
>
>
>
>		
>__________________________________ 
>Yahoo! Music Unlimited 
>Access over 1 million songs. Try it free. 
>http://music.yahoo.com/unlimited/
>
>
>  
>


-- 
Best Regards,
Lance James
Secure Science Corporation
www.securescience.net
Author of 'Phishing Exposed'
http://www.securescience.net/amazon/
Find out how malware is affecting your company: Get a DIA account today!
https://slam.securescience.com/signup.cgi - it's free!