When I looked at the chat FAQ and clicked the link to take me to Sandbox I got this pop-up, which seems a little bit odd:

Now, when I Googled plzz.de, I found a website about Stefano Palazzo, who happens to be a Stack Exchanger. When I added :9993 to the web address, I got the same pop-up.

So I ask you: What does it mean, why is it here, and is it supposed to be here?

  • Does anyone else get this when they click the link to Sandbox? – please delete me Jan 4 '12 at 6:05
  • I did once, but refreshing the page, etc would not reproduce multiple times. I'd assume there's some kind of weird image URL or something on the page that someone put in there just to mess around. – animuson Jan 4 '12 at 6:10

Stefano was illustrating a potential exploit where returning an 401 Authorization Required status for an image resource (which you can embed, say, in chat) will cause certain browsers to show the authorization dialog, which could cause some unaware user to mistakenly disclose some sort of credentials.

That message should probably be removed now that he's illustrated his point. Ideally the browser shouldn't be showing that dialog at all (Chrome started preventing the dialog from appearing in this case in May of last year), and Stefano filed a bug report for Firefox to that effect.

So, to more directly answer your question: It means that your browser is vulnerable to the exploit (if you consider it an exploit), it's there because Stefano wanted to bring it to the attention of the Stack Exchange developers, and it probably does not need to be there any longer, since the point has been proven.

  • Apparently it's an exploit in Safari too... – animuson Jan 4 '12 at 6:12
  • I see. That is good to know, because it looked a little odd to me. – please delete me Jan 4 '12 at 6:12

Stefano Palazzo posted an image that caused it to demonstrate a security vulnerability. He explained it here:

@balpha here's a security vulnerability
I can't think of a fix though (: (possibly do a HEAD on images, remove if it looks suspicious)
(this is the code, it's completely trivial: paste.ubuntu.com/788593)
and sorry to everyone else for the annoying pop-up

I deleted the message, so your browser won't request the image anymore and you won't get the popup

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .