Hacker News Reader

Comment by blauwbilgorgel | Hacker News Reader

The proof of concept is foiled. But how about something similar like:

  <noscript>
    <meta http-equiv="refresh" content="600" 
    url="phish.php"> 
  </noscript>

View on HN

I believe NoScript will pop up a message asking if you want to take the redirect, in that case.

I think you are right:

"Forbid META redirections inside <noscript> elements"

but then I immediately wondered, what about META redirections outside <noscript> elements? I tested this with a fresh install of Firefox and latest NoScript, and those still work. Also: To forbid meta redirections inside noscript elements you have to toggle an option, it's not standard for non-trusted sites.

Did you test the META redirection with a background tab? I'm pretty sure NoScript added an unconditional block of background redirects within a week or so of this attack being publicized.

Reply on news.ycombinator.com