full-disclosure-uk December 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] Google / GMail bug, al

Re: [Full-disclosure] Google / GMail bug, all accounts vulnerable

From: Peter Besenbruch <prb_at_nospam>
Date: Wed Dec 12 2007 - 19:49:56 GMT
To: full-disclosure@lists.grok.org.uk


On Wednesday 12 December 2007 08:05:35 Steven Adair wrote:
> You aren't really able to take action on Google's site per the
> real definition of CSRF.
CRSF: Canadian Rope Skipping Federation (Google's "I'm feeling lucky") Center for Research on Sustainable Forests Canadian Rhodes Scholars Foundation CReative Santa Fe Consolidated Rail System Federation

I keep wondering when people on this thread will discuss the relative merits of various rope materials? That is the "real definition" isn't it? ;)

On a more serious note, I agree with the question; it doesn't sound like a full cross site request forgery. Still Coderman's reply to your questions lead me to search for information on the Firefox "browser.chrome.favicons." That lead to this bit of information:

"Caveats

" * browser.chrome.site_icons must be true for this preference to have an effect.
" * Conversely, browser.chrome.site_icons should be false when this preference is false to disable site icons and favicons completely."

http://kb.mozillazine.org/Browser.chrome.favicons

Given Coderman's statement about meeting "fortuitously in a black hat tryst," I set both to false. Thanks all for the info.

And for those people, like myself, who aren't up on all the acronymns, here is a link for CRSF:

https://secure.wikimedia.org/wikipedia/en/wiki/Csrf -- Hawaiian Astronomical Society: http://www.hawastsoc.org HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/