971597 - (dev-self-xss) [meta] Prevent "Self-XSS" attacks that involve developer tools

Status: NEW

(DevTools :: General, defect)

Comment 1

[Jesse Ruderman]

I was too optimistic in the last paragraph of bug 527530 comment 57. Scammers on Facebook are now asking users to paste malicious JavaScript into the developer console. This leads to hilarity like:

* https://www.facebook.com/selfxss
  * Allow my account to be hijacked if I paste malicious JavaScript

* Facebook taking advantage of a bug (?) in Google Chrome to disable the console
  * http://stackoverflow.com/questions/21692646/how-does-facebook-disable-developer-tools

Comment 2

[Joe Walker [:jwalker]]

I'm not sure that fixing bug 934497 would do anything do anything significant to solve this problem. The majority of users wouldn't disable developer tools, and we're not going to disable developer tools by default. Feel free to re-add if I'm missing something.

Comment 3

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

Bug 953166 could help prevent this sort of thing.

Comment 4

[Joe Walker [:jwalker]]

Remove the wrong bug earlier. Bug 934497 isn't important to this problem.

Comment 6

[Eric Mill]

For reference for anyone reading this thread, here's the parallel Chrome bug: https://code.google.com/p/chromium/issues/detail?id=345205

Comment 7

[Christian Holler (:decoder)]

Unassigning because it is unlikely Jesse will work on this. Leaving it open because it is a meta-bug with open bugs blocking it.