Hacker News Reader

It's only strange at first sight. If your site depends upon browser-specific features as the sole source of a security mechanism, it stands to reason that it will turn into pain for you.

This is another solid example of the lesson: if the user controls it, the input is malicious. Always.

This isn't unprecedented. IE6 has been used to attack websites in the past. http://www.theregister.co.uk/2010/02/01/ie6_microsoft_uk_gov...

Max Butler is famous for using the HTML application in IE to harvest credit card information way back in 1999.

The way I understood the article is that this relies on harvesting data from users on your site. As you cannot control which browser your users have, the point here is that this exploit relies on a vulnerability in a mass-adopted browser.

I'm not sure what you're suggesting when you suggest not relying on browser implementation. This sounds impossible as the browser is the client and the client will have access to user credentials.