Hacker News Reader

I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.

In principle, it's not a mitigation - I was just too lazy to forge an interactive URL bar! You could make one which acts just like the Chrome URL bar, but e.g. acts as a MITM.

At first I though you wouldn't be able to stay "in the middle" because you'd have to redirect to the typed address. You can't AJAX it in, because of CORS.

But you could go to your own host and have your server sit in the middle. The user wouldn't be logged in, since cookies wouldn't be sent. But maybe they would login through your proxy.

You can simulate that though since it's an html element being rendered with css.

Reply on news.ycombinator.com