I think you are right: *"Forbid META redirections inside <noscript> elements"* b... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		blauwbilgorgel on Sept 9, 2014 \| parent \| context \| favorite \| on: Tabnabbing: A New Type of Phishing Attack (2010) I think you are right: "Forbid META redirections inside <noscript> elements" but then I immediately wondered, what about META redirections outside <noscript> elements? I tested this with a fresh install of Firefox and latest NoScript, and those still work. Also: To forbid meta redirections inside noscript elements you have to toggle an option, it's not standard for non-trusted sites.

wtallis on Sept 9, 2014 [–]

Did you test the META redirection with a background tab? I'm pretty sure NoScript added an unconditional block of background redirects within a week or so of this attack being publicized.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact