Hacker News Reader

Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get access to my-cool-site.com DOM, if you're leveraging this bug.

View on HN

But, my-hacker-site.com could, instead of including an iframe to my-banking-site.com, simply do a server-side proxy of your bank and execute a pretty effective phishing attack.

The advice I've seen re:phishing is usually to check the URL. That doesn't help here.

Check the URL is not a solid advice, there are many ways to trick you (e.g. google.com vs goog1e.com). Enter the URL yourself is a better one.

Reply on news.ycombinator.com