Sigh

[bryant]

I'm not clicking on any links in LiveJournal entries until they fix the security hole. Recommend you don't either. Long story short, it's immensely easy to set up a page which, when you view it, will post something to your journal. That something can include a link to a page which, when you view it -- well, you get the idea.

I don't see any password theft vulnerabilities but I haven't really put too much effort into thinking about it, so I could be wrong.

I also have no idea how this gets fixed.

Sigh.

Comments

[gentlyepigrams]

That was one of my first thoughts about that meme--my first one other than "huh?", in fact.

[bryant]

There's a decent approach to fixing it here:

http://www.livejournal.com/community/lj_dev/641972.html

I'm going to post and urge bradfitz to not worry about the poorly implemented clients which may suffer as a result of implementing the fix.

[gentlyepigrams]

Yeah, pretty much. Use the API, Luke!