Hacker News Reader

Can you explain? My understanding was that cookies will not be sent in these attacks (I validated this only testing some approaches, namely doubleclick and other ad embeds). Without cookies, how would the CSRF attack access my account? Or have I missed something obvious?

View on HN

Disabling third party cookies disables cookies in certain contexts, like when loading images and frames from another domain, but there are other ways to perform a CSRF attack. A link or form that doesn't target a frame would still work.

Got it that makes sense. It seems like a link would be a real problem to solve and keep the web usable. The form approach seems easy enough to solve with a dialog. The others that can be solved via tighter cookie restrictions probably should be.. Too many permission dialogs and you end up annoying the user, or worse, train them to accept without reading.

Reply on news.ycombinator.com