Sigh

[bryant]

I'm not clicking on any links in LiveJournal entries until they fix the security hole. Recommend you don't either. Long story short, it's immensely easy to set up a page which, when you view it, will post something to your journal. That something can include a link to a page which, when you view it -- well, you get the idea.

I don't see any password theft vulnerabilities but I haven't really put too much effort into thinking about it, so I could be wrong.

I also have no idea how this gets fixed.

Sigh.

Comments

[merlinofchaos]

Could you post a link to a source or something? This is the first I've heard of it, and I'm curious for more information.

[bryant]

http://www.livejournal.com/community/lj_dev/641972.html

[head58.livejournal.com]

But if we're not supposed to click on links in LJ entries...