Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #25561

Re: Checking Loading Status of Cross-Domain Child Window

Show all headers | View raw

Win User schrieb:

> Now while I perfectly understand script executed from a document from one
> domain not being at all able to read from and write to content of a document
> (loading or loaded) from another domain, I don't see the security flaw in
> one document opening a child window and getting a signal "the document is
> loaded" event.  Perhaps someone can tell me why a "child window content
> loaded" signal--with no ability to know the content of it---would be of
> great interest to the malevolent hacker.

Even the fact *that* it has been loaded would be a privacy issue and 
might help to execute attacks on the foreign domain. Also, the timing 
information could give you knowledge about whether the requested 
ressource(s) have been in the cache, i.e. been visited previously.
If you search for "timing attacks" you might understand how useful such 
information can be (even if most of it is about crypto algorithms, there 
have been timing attacks on the web 
<http://www.contextis.com/documents/2/Browser_Timing_Attacks.pdf>).

> Apparently there are solutions when using HTML5 in one document from another
> domain in "messaging" another,

All these communication techniques are based on explicit, mutual 
agreement in both documents. Google will hardly accept any messages that 
you send to their homepage document.

 > and even in peering into content (using content in the form of JSONP
 > and using proxy servers, no matter what DOCTYPE).

Those are not needed to be protected by the SOP. The point is that these 
are not using the user's credentials to request the ressources, but 
simple access freely available data on the web.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Checking Loading Status of Cross-Domain Child Window Win User <winuser@ms.invalid> - 2014-07-24 15:42 +0000
  Re: Checking Loading Status of Cross-Domain Child Window Joao Rodrigues <groups_jr-1@yahoo.com.br> - 2014-07-24 19:02 -0300
    Re: Checking Loading Status of Cross-Domain Child Window Win User <winuser@ms.invalid> - 2014-07-24 22:40 +0000
      Re: Checking Loading Status of Cross-Domain Child Window Andreas Bergmaier <andber93@web.de> - 2014-07-25 01:28 +0200
        Re: Checking Loading Status of Cross-Domain Child Window Win User <winuser@ms.invalid> - 2014-07-25 00:34 +0000
          Re: Checking Loading Status of Cross-Domain Child Window Andreas Bergmaier <andber93@web.de> - 2014-07-25 04:31 +0200
    Re: Checking Loading Status of Cross-Domain Child Window Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-07-25 11:59 +0200

csiph-web