[bitwize]

"In all seriousness, this attack vector is pretty slim. You’ve got to tempt unwitting users to visit your site, and to stay on it while they’re developing JS code."

Wrap the exploit up in a blog post about Rust -- or an article about gut bacteria -- and submit it to Hackernews. Boom, a virtual feast of secrets.

[spookyuser]

Or even better wrap it in a blog post titled: Stealing secrets from developers using WebSockets

[codazoda]

Exactly. I've got a blog with dozens of technical documents about JS and other topics. That would be an ideal place to harvest this type of information, from developers actively looking for a solution to a particular problem.

[bryanrasmussen]

So the blog should have articles on how to set up and log into Service X using React! This explains why I see so many of these!

[earthboundkid]

The average post quality on Proggit has gone down a lot in the last year. It would be funny if this were why.

[wlesieutre]

Or shotgun it out to the web over a compromised ad network, as has been done with other attacks

[pheme1]

Another idea: an online json editor

[FridgeSeal]

Are these not already phishing sites of some kind?

I used to have some co-workers who would dump json docs containing sensitive information into these sites all the time, and despite showing them how to format stuff in VS Code.

[slimsag]

Wouldn't be hard to adapt this to be literally one of your VS Code extensions.

https://github.com/microsoft/vscode-extension-samples/blob/m...

[throwaway2048]

How many people post on here about having hundreds of tabs open?

[suzzer99]

Exactly what I was going to post. At any given time it's about 80% likely SO is going to be open in at least one of my chrome tabs.

[api]

"Gut bacteria influence proficiency at Rust programming."

Could that be the highest voted link in HN history?

[techbio]

Nice try.

http://www.hntoplinks.com/all

[talmr]

What is stopping facebook, Reddit, or another popular site you have open while you're developing add this kind of thing and get user info? Or am I misunderstanding something?

[t0astbread]

Theoretically nothing but it'd probably be a PR disaster even for a site like Facebook if people found out it was trying to steal their passwords. (Is that even legal?)

[gentleman11]

Would it? They do this sort of thing constantly. Recently Facebook was accused of trying to acquire a malware company to get at user data after iOS security restrictions became tighter. They were also accessing people’s email accounts after requiring their email passwords for login to facebook

[DreadY2K]

Technically, you only get legal issues if you do anything bad with the stolen passwords, but it'd totally be a PR disaster so they wouldn't do it anyways.

[whatatita]

Since passwords are GDPR protected data, just saving them (and not using them) without consent is at least a breach of GDPR and illegal in most EU member states.

[bryanrasmussen]

This is only so if the complaint I always see here that people don't read the articles is false though.

[zwetan]

well that very same attack vector aka "visiting a web site" is what everyone had against Flash

how convenient to consider that "pretty slim" now

[skoskie]

Why would anyone trust that Facebook isn’t already doing things like this?