Hacker News Reader

How is this any different in principle than $.get("page", function(result){document.body = result;}); ?

If the attacker can run the javascript you mentioned, they've already run.

The "benefit" is that it causes a "trusted" tab to change, not a new one that a user might expect to be tainted. If I open a link from HN (for example), read it, and close the tab, I'd expect to be back at HN. If the link changed my `window.opener` url to a fake-HN, I could do some action that asks for a password or some similar data. It's more likely to succeed since the user already trusts the existing window/tab/site.

Reply on news.ycombinator.com