Hacker News new | ask | show | jobs
by withinboredom 575 days ago
Since when can you trust js?
1 comments
0x073 575 days ago
Big websites use js and if they leak most of the time it's not a js issue.

I think the distrust of js is a personal issue.

link
withinboredom 574 days ago
I mean, anyone can open devtools and change the code to do whatever ... or install an extension that does it. So, since when can you guarantee that a browser client will actually do what you program it to do? In my experience, you can't guarantee anything on the client -- since forever. I was asking when/if that changed. I don't see why you would make that a personal attack?
link
0x073 573 days ago
But that a general problem, having a html only page with a form is the same problem. Only transfer what the user should see.

You need server verification for data that's important. Native programs can be changed with over programs or hex editor.

The talk was about data that is stored into cookies as json and csrf. (Cookies can be changed with devtools or extension)

Csrf is always an attack from third party against the user, if the user extract the data itself that's no csrf problem.

Because of this I thought you distrust js that can get attacked from third party, but yes js is as easy to change like .net or java programs.

link