On Wed, Oct 7, 2009 at 9:37 AM, Adam Barth <cap-talk at adambarth.com> wrote: > If I'm able to mount a GIFAR attack, then I already have all the > privileges I could possibly obtain via CORS. Actually, I lied. This isn't true. Adam