Hacker News Reader

Would the type of people amused by this have that weakness though?

It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home.

Unless there's a workaround I'm not thinking of.

Can't you embed off-site images?

GitHub pages are served with Access-Control-Allow-Origin: *, so the SOP doesn’t apply.

They also don’t set a CSP header, which opens up the opportunity to exfiltrate data by other means, e.g having the browser load an image on your.site/$password.jpg.

Ah right. Simple!

The CORS policy is set by the server receiving the request, not the page/server sending it.

Well damn, I’ll have to change Hunter2 everywhere now.

is a password very useful without any other identifier though?