September 7th, 2008 Update: 10.09.08: As from today on, due to an update from Chrome the :% issue is no more valid.
Rishi Narang has been the first. A Denial Of Service simple as pie:
Just browse this page and place your mouse over this link (make sure you bookmark this page if you want to read on though):
CRASH ME
Just “evil:%” in the anchor text is capable of crashing all the Chrome tabs (despite all the tabs are separated processes).
Someone has also reported that by entering a very long bookmark may kill the browser. Length has not been given but it’s worth a try.
If your Chrome is still alive you may want to try entering
about@:
in the location bar.
Good thing is that the browser doesn’t need Read the rest of this entry »
August 30th, 2008 Shared by natadd
Very important!! You should always use SSL (https://) for Gmail!
A tool that automatically steals IDs of non-encrypted sessions and breaks into Google Mail accounts has been presented at the Defcon hackers’ conference in Las Vegas.
Last week Google introduced a new feature in Gmail that allows users to permanently switch on SSL and use it for every action involving Gmail, and not only, authentication. Users who did not turn it on now have a serious reason to do so as Mike Perry, the reverse engineer from San Francisco who developed the tool is planning to release it in two weeks.
When you log in to Gmail the website sends a cookie (a text file) containing your session ID to the browser. This file makes it possible for the website to know that you are authenticated and keep you logged in for two weeks, unless you manually hit the sign out button. When you hit sign out this cookie is cleared.
Even though when you log in, Gmail forces the authentication over SSL (Secure Socket Layer), you are not secure because it reverts back to a regular unencrypted connection after the authentication is done. According to Google this behavior was chosen because of Read the rest of this entry »
