Title and summary	Date/time
1	Fixing browser security: SameRefererOnly Web security is horribly broken, and lot has been said about CSRF, XSS, DNS-Pinning, etc, but not enough about what we can do to fix the mess. I think we could adapt an idea like HttpOnly to tackle CSRF - I'd like to see a "SameRefererOnl...	07-Aug-2007
2	CSRF, Anti-DNS Pinning and NTLM Mark Goodwin has written a neat discussion of the extra problems that CSRF causes when used alongside DNS pinning attacks and against intranets that use NTLM authentication (AKA Integrated Windows Auth) The short version is that you might be able to u...	18-Apr-2007
3	How to Protect a JSON or Javascript Service There have been lots of explanations recently of the dangers of JSON or JavaScript remoting. This post is about what you can do to protect your scripts. The Problem The issues have been explained before, so I'm going to assume some knowledge of the p...	04-Apr-2007
4	JSON is not as safe as people think it is I saw some discussion recently about using JSON for secured data, and I'm not sure that everyone understands the risks. I believe that JSON is unsafe for anything but public data unless you are using unpredictable URLs. There are 2 problems. CSRF (Cr...	05-Mar-2007
5	CSRF Pharming In short: If you still have the default password on your router then go and change it now. Don't stop to read this post before you change it. This post describes an attack that combines CSRF with an older technique - Pharming (see particularly the sec...	08-Feb-2007
6	CSRF Protection It occurred to me that there is another way of providing protection against CSRF attacks, in addition to the ones already mentioned on Wikipedia. There are several ways to forge a request in a CSRF attack: iframe, script tag, image tag, scripted windo...	07-Feb-2007
7	CSRF Attacks or How to avoid exposing your GMail contacts GMail is having a hard time at the moment, the latest problem is a CSRF flaw that allows anyone to read your GMail contacts. CSRF is commonly mistaken for Cross-Site Scripting (XSS); the article linked to by Digg makes this mistake, but the 2 attacks ...	01-Jan-2007