@StefanoPalazzo What the... Oh I see, thanks for bringing this to the attention of the community(and also the mods I hope).

@StefanoPalazzo Actually... first of all, that's up to browsers to fix. (It doesn't work on Chrome, for example)

I don't think the browser vendors can fix this

and SE can't either, unless they're willing to actually do a request for each image that's posted. If they are, it's an easy fix

the problem is that secure resources need to be got at, and in the usual scenario the password would be cached by the browser. they could implement some kind of same origin policy for authorized resources of course

it's really not a problem on SE, we have moderators to deal with this. I just thought it was a funny 'hack'

:)

I got the idea from a sort of novel cookie stealing attack presented at the 28C3 conference, which works because browsers prefer cookies for more specific paths (as in a.b.c.stackexchange.com/x will be preferred to stackexchange.com/x by browsers)

@ArdaXi weird; it works for me. (chrome 17)

It's really not a problem.

This is also Chrome 17 and I see the image without any pop-up, so I'm assuming Chrome just ignores the auth header.

Nobody, and I mean nobody uses basic HTTP auth to do any kind of authorization unless they have a very good reason to do so.

Therefore I can't imagine anyone even filling it out.

kind of hard to test

I don't think there is a way to clear cached basic auth credentials in chrome

I guess I was wrong, I can't get it to pop up in private browsing either

I can't imagine anyone filling it out either :) And like I said, in a real room, this would quicky be removed by a moderator

I'll just file a bug at firefox (:

Anyone got the pop-up telling you to enter your username and password ?

and it says that it is malicious ?

Hello ?

@Shadezguy hi

I made that the other day, it's just an example for a security problem

I don't snoop any passwords of course

I've also filed a bug against firefox: bugzilla.mozilla.org/show_bug.cgi?id=714543

if you have entered a password, it will have been transmitted in the clear, but discarded at the server (not saved, not logged)

@StefanoPalazzo nice bug.

was trying to figure out why i wasn't experiencing it, then realized i'm using chrome and not firefox.

It's... well... the oldest trick in the book really.

right, I don't claim to have invented it :D

I remember seeing it often on forums, back in the day.

given it is a rather obvious trick though, it's interesting it still works in firefox

I can't think of a good reason not to have a same origin policy for basic and digest auth

Yeah.

Then again, I can't think of a good reason to support basic auth.

I use digest auth for CouchDB (from and to localhost) sometimes. it's rather nice

figure it out @MarcoCeppi?

cool

@jrg Yeah, these will work now

awesome