This thread isn't getting any younger, but... Following the news the other day that IE doesn't actively implement DNS-Pinning; it seems Firefox (2.0.0.4) DNS pinning is either non-existent or somewhat strange too. Take a look and let me know what you think http://getahead.org/blog/mark . Goodwinster
Forum: Networking

Because the *read* data that's fetched from a forged request, at the moment you have to have it returned as JSON or valid javascript. If you can force the interpreter to see HTML / XML as valid JS, you can read anything.
Forum: CSRF and Session Info

Has anyone seen Joe Walker's blog post on CSRF possibilities in JavaScript 2 yet? If so; what do you think?
Forum: CSRF and Session Info

Hi; I'm goodwinster. I'm a security geek based in Leicestershire, UK. You might have seen some of my work on Joe Walker's blog. I've been hanging around for a few months now; thought I'd join in the fun.
Forum: Intro