The browser is not a witness
· 5 min read
We found the same hole twice, in two systems written a year and a half apart by people solving unrelated problems. Neither was a subtle cryptographic mistake. Both were the same sentence, written twice:
The browser told us which organisation this request is for, and we believed it.