None of this required Javascript. At all. The same potential attack could have been done with good ol' forms. Sure, you think you're signing into "BigBensSuperStore.com", but you're actually handing your credentials right over to "BigBensSuperStore.net".
replyJavaScript (and other forms of executing logic within the browser) have made the situation worse, though.
replyTo me, there's a big difference between a domain misread and actively malicious code running in the browser context as a design point.
If a malicious site gets your password, I'm not sure why it matters whether it happened in the frontend or not.
reply> "The web" was never designed to be an application platform. It was only designed to be a document platform.
replyAnd then it expanded to serve the needs of billions of people instead of the needs of a few researchers. Womp, womp. Get over it, use a JS-free browser to browse your documents, and accept that the world has moved on. Or don't, and rant at clouds, I guess.
You realize the same argument applies to Word macros.
reply