Hacker News new | past | comments | ask | show | jobs | submit login

> exfiltration is obviously possible, I’m not sure why I would even need to specify that any page is able to read its own contents using JavaScript

Things that are obvious to you may be non-obvious to other people, including the readers of your blog.




In the context of their blog post, it's assumed that the reader has some knowledge of web technologies — if you can print data to your own webpage, you can also exfiltrate it.

It's not reasonable to expect the author to explain _every_ underlying technology involved since that was likely not the scope of the post.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: