How can a comment on a web page steal your login?
In 2005 a harmless-looking line on one MySpace profile spread to over a million accounts in 20 hours.
βΆ Start the storyA comment can steal your login when a website displays what people post without making sure it is only text. Web pages are made of text, but part of that text is instructions that your browser follows, such as a small program that runs on the page. If a site pastes a stranger's comment into the page as it is, and that comment contains instructions instead of words, your browser cannot tell the difference. It runs them. This attack is called cross-site scripting, or XSS.
The reason it is dangerous is trust. Your browser gives each website its own permissions, and the rules around this are called the . The page with the planted instructions really did come from the trusted site, so the browser runs them with that site's permissions. Those permissions include things like the that keep you logged in. That is how a harmless-looking comment becomes a way to act as you.
The most famous case is the Samy . On 4 October 2005, a programmer named Samy Kamkar released a small worm on MySpace. Anyone who looked at an infected profile got it copied onto their own profile, and then so did everyone who looked at theirs. Within 20 hours, over one million users had run it, the fastest spread of any virus ever. It was relatively harmless, just adding a line to profiles and sending Samy a friend request. In 2006 the US Secret Service raided him, and in 2007 he entered a plea agreement to a felony charge.
20 hours
The defense is to treat everything users write as text to display, never as instructions. Websites convert special characters into a safe form before showing them, a step called , and browsers add extra safeguards. When it is done consistently, the comment box is boring again.
Quiz me
0/3
Recap
Show user content as text, never as instructions: escape it before it goes on the page, and add layers like HttpOnly cookies.
π‘ A trick to remember it Β· Put the comment in a glass jar before it goes on the shelf: people can read it through the glass, but it can never reach out and press a button.
Surprising fact Β· The Samy worm reached over one million MySpace users within 20 hours in 2005.
Sources (2)
No source, no claim. Every fact in this lesson (17 claims) cites at least one of these.