technoguyrob

EDIT: To answer your question of "are they doing some kind of lookup for each AJAX request?" Well of course, since they already have to look up a user's ID, account information, etc. based on the cookie they send.

Comment · 18 years ago

And the Gmail engineers should add an opt-out "high security" mode that checks the referer to make sure the form submission is coming from Gmail itself and not some outside website. This way people who like to use custom/blank referers can ignore this security concern if they want, and all the rest of us can prevent the risk of this problem.

EDIT: Or how about just adding an in-line Javascript variable? Say, on all Gmail pages, you could embed this in the page:

   <script>var SECURITY_KEY = "918028cd79a5ba47e83e6ba68d036ca3";</script>

And then when sending AJAX or form requests in the background, make sure to include that as a request parameter. That way, even if the user has the right authentication cookies, external websites won't be able to fool Gmail into thinking they are Gmail.

Really, this doesn't seem like a very hard problem to solve...couple lines of code...

Comment · 18 years ago

Reading that article made me expect a future in which a musician will not be known for a particular composition, but for the algorithm he devised for creating music of a particular flavor.

This only goes to show that eventually, all fields of knowledge will be nothing except mathematics!