Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Certainly not the worst approach, but it might turn out far less watertight than hoped. E.g. plenty of places in html-based UI where you can sneak in an URL that pulls some image, with all the data sent upstream you can fit in a GET. And good luck noticing, when everything is on https and someone decided that certificates should be pinned.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: