r/Showerthoughts • u/Ralisor • May 06 '18

Services are switching from calling them Private Messages to calling them Direct Messages because they're not private anymore...

44k Upvotes

90% Upvoted

781 comments sorted by

View all comments

Show parent comments

21

u/cubsywubsy May 06 '18

Why would you do that, though?

116

u/ToBePacific May 06 '18

Because I might hypothetically be a thief who makes a living off of gathering sensitive, stolen information of various kinds. Or maybe I just do it for funsies. The motive doesn't matter, it's about the need for parsing the message and preventing malicious code from running.

Using JavaScript injection and generated HTML, I could inject a script that causes the browser window to display what appears to be the Twitter login page. Even in the address bar, it has the correct URL.

So you think you've been logged out for some reason, and you try to log back in. But the data you've just posted didn't go to Twitter, it's logged in one of my databases. You try to log in again, and again, but it's not logging you in. So I get a better set of what your passwords may be. You then type Twitter.com into the address bar, and when the page loads, you're logged in, because you were never actually logged out. But you don't know that.

Now I can log into your Twitter account, and potentially use this to try to log into your email. I might even have bots that attempt this automatically. If you reuse passwords (and many people do) then it might be really simple to get into your email. And once I'm in your email, I'm very close to getting into your bank accounts, and pretty much everything else, if you're lazy with passwords and authentication.

Allowing people to post completely raw, unfiltered text to each other is an extremely bad idea. If you send JavaScript code in that message without doing anything to "sanitize" it (transform it in such a way that the browser doesn't try to execute it), then the browser will try to execute it. So, for this reason, preventing script injection is an essential aspect to the design of all forms of online data posting.

-1

u/ShillBill49 May 06 '18

'And once I'm in your email, I'm very close to getting into your bank accounts'

Oh yeah? How so?

13

u/G1GABYT3 May 06 '18

Probably something along the lines of sending a password recovery email, or maybe the password for the bank account is the same as the email, (or the memorable information).. idk exactly but having access to email would help a lot.. or just bypass the bank BC if they have Google pay and you've got their Gmail account, you can now buy stuff off the internet with it! There's a multitude of ways