Quote from: Mabsark on January 15, 2015, 01:23:40 AM

Quote from: darkgamer on January 14, 2015, 05:47:21 PM

*update looks like hashie had control of email since it was started https://code.google.com/p/chromium/issues/detail?id=429395 Security: Window.opener bypasses same origin policy
   1 person starred this issue and may be notified of changes.    Back to list
Status:    WontFix
Owner:    ----
Closed:    Nov 2
Type-Bug-Security

Add a comment below

Reported by ad...@glados.cc, Oct 31, 2014

VULNERABILITY DETAILS
Opened windows (through normal hrefs with target="_blank") can modify window.opener.location and replace the parent webpage with something else, even on a different origin (bypassing same origin policy).

While this doesn't allow script execution, it does allow phishing attacks that silently replace the parent tab (which a user already mentally trusts).

window.opener.location should not be modifiable if on a different origin.

VERSION
Chrome Version: 37.0.2062.94 + stable
Operating System: Ubuntu

REPRODUCTION CASE

https://hashie.co/chrome/demo.html

That could have been someone completely different just using that as their username there. It's not though. It is TradeFortress as the same user made an earlier post here:

Quote

Oct 16, 2013
#2 ad...@glados.cc

I am also experiencing this bug on my website, https://coinchat.org .

So, there's now a definite link between TradeFortress and hashie. Interesting.

So trade is a serial scammer?