HNHacker News
TopNewBestAskShowJobs

hashtagInsecure

35 karma · joined February 21, 2017

submissionscomments
hashtagInsecure··on Time to Encrypt the Cloud
https://www.schneier.com/blog/archives/2015/05/detecting_qua...
hashtagInsecure··on Time to Encrypt the Cloud

  We do this by adding a hash character (#) to a link. 
  By design, browsers don’t share anything after this 
  character.
...and I stopped reading there.

It is astonishing to read that. Just absolutely mind blowing.

Browsers absolutely can and DO share things coming after the hash (#) character in a URL. How?

JavaScript! It's absurdly easy to siphon anchor hashes out of the address bar with JavaScript, and send them back to the mothership, or anywhere else for that matter. It's basically how oh-so-many Very Big Websites work.

Are you kidding me?!