This might be a worm, C! Delete the post now, clear your cookies, change your LJ password. See above link for explanations. It's not certain that this thing can swipe your password, but it might be able to.
one of the best explanations in response to that post indicates why this shouldn't be a problem, with this one at least:
The cookie does not appear to be compromised at all. The script creates a page with a Livejournal submit form, complete with entry and a hidden field that tells the livejournal update script to check for a cookie for authorization. It then submits that form to Livejournal using javascript. Functionally, this is like you filled out the form and pressed the button yourself. Livejournal gets the form submission, asks your browser if it has a cookie, and if it does, accepts the post. The only data ever sent to the script is your username, and it can't be modified to get your cookie. The cookie only travels between you and Livejournal
( ... )
Comments 2
This might be a worm, C! Delete the post now, clear your cookies, change your LJ password. See above link for explanations. It's not certain that this thing can swipe your password, but it might be able to.
Reply
The cookie does not appear to be compromised at all. The script creates a page with a Livejournal submit form, complete with entry and a hidden field that tells the livejournal update script to check for a cookie for authorization. It then submits that form to Livejournal using javascript. Functionally, this is like you filled out the form and pressed the button yourself. Livejournal gets the form submission, asks your browser if it has a cookie, and if it does, accepts the post. The only data ever sent to the script is your username, and it can't be modified to get your cookie. The cookie only travels between you and Livejournal ( ... )
Reply
Leave a comment