Hacker News Reader

I wonder what are implications of having XSS on .google.com these days? All auth cookies are likely to be http-only, so probably not a serious vulnerability?

View on HN

http://lcamtuf.coredump.cx/postxss/

It's a good writeup about the post-xss world and what kind of attacks are still exist.

Reply on news.ycombinator.com