full-disclosure - Re: Google / GMail bug, all accounts vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 12 Dec 2007 09:49:56 -1000
From: Peter Besenbruch <prb@...a.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Google / GMail bug, all accounts vulnerable

On Wednesday 12 December 2007 08:05:35 Steven Adair wrote:
> You aren't really able to take action on Google's site per the
> real definition of CSRF.

CRSF:	Canadian Rope Skipping Federation (Google's "I'm feeling lucky")
	Center for Research on Sustainable Forests
	Canadian Rhodes Scholars Foundation
	CReative Santa Fe
	Consolidated Rail System Federation

I keep wondering when people on this thread will discuss the relative merits 
of various rope materials? That is the "real definition" isn't it? ;)

On a more serious note, I agree with the question; it doesn't sound like a 
full cross site request forgery. Still Coderman's reply to your questions 
lead me to search for information on the Firefox "browser.chrome.favicons." 
That lead to this bit of information:

"Caveats

"    * browser.chrome.site_icons must be true for this preference to have an 
effect.
"    * Conversely, browser.chrome.site_icons should be false when this 
preference is false to disable site icons and favicons completely."

http://kb.mozillazine.org/Browser.chrome.favicons

Given Coderman's statement about meeting "fortuitously in a black hat tryst," 
I set both to false. Thanks all for the info.

And for those people, like myself, who aren't up on all the acronymns, here is 
a link for CRSF:

https://secure.wikimedia.org/wikipedia/en/wiki/Csrf

-- 
Hawaiian Astronomical Society: http://www.hawastsoc.org
HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/