bk99.de entertain the web since 1997

bk99.de
HN · Web securityCurated

Tabnabbing: phishing via forgotten browser tabs

Summary

Aza Raskin shows how an unattended browser page changes its appearance and title and poses as a familiar login service when the user returns. Phishing exploits memory and attention just as deliberately as technical vulnerabilities. Security indicators help little if people do not check the origin of an old tab again.

Ideas

  • The attack waits until the user no longer remembers the tab's original content.
  • Favicon, title and form imitate a known service without a new pop-up.
  • A redirect after the input can additionally conceal the fraud afterwards.

Recommendations

  • Use password managers, because they only offer credentials for the matching domain.
  • Check the address and TLS origin before logging in again in an old tab.

References

Read the original post

Search the Web Archive

HN · 2016

A practical security guide for web developers

Fallible collects concrete rules for input validation, authentication, sessions, cryptography, dependencies and secure delivery. The guide is maintained publicly on GitHub. It covers backend, frontend and infrastructure.

HN · 2026

Dirty Frag: a note on a Linux privilege escalation

The oss-security post describes a chained local Linux privilege escalation and its problematic disclosure before a coordinated fix. The publication contains working demonstration code for x86-64 systems. Chaining vulnerabilities makes individually limited bugs system-critical together.