Will a brilliant mind, like Daniel Sepczuk’s, fall into my fiendishly clever trap?

There is a vulnerability here at LG which enables an unscrupulously deceptive player to trick an unwary opponent into unwittingly sending the game server whatever move they (the diabolical fiend) desire, so long as it is a valid move for an active game. The method to accomplish this trickery is very simple and requires no knowledge of java, and only a little knowledge of how to embed html. It took me about 5 minutes to come up with the plan. This here is an example of an embedded link to my game with Daniel.

When Daniel views our game he sees a message at the top that contains a hyper-link that, if he clicks it, tells the game server that p5 (??) is his next move. The underlying html is hidden from his view, he only sees what I want him to see (the blue text of the hyperlink), not the URL or code.

Do you think he'll fall for it?

Do you think he'll get upset?

How long will it take the webmaster to fix this?

Scary. And perhaps difficult to counter by the web-master? I hope there is a simple solution to fix this - and that no-one tries to exploit it.

I doubt this will be fixed by the webmaster, but tbh you shouldn't click on suspicious links from your opponent. I do agree, however, that this might be a problem since many people click on many links every day.

If someone sends you a link in a message, be careful before you click on it, or just don't.

If for some reason the browser does not show the URL in the status bar, press right button and "copy link location" and paste it somewhere to see what it is.

Nobody with a brain here on LG would do such a cheat.

We would recognize it very soon, and then his dirty name

would be written on every wall.

Is javas-cript filtered out in game messages? If not, it would not be difficult to automatically submit a move for the opponent when they open the game, for example by changing window.location.

I would rather not test it out for fear of being auto-banned. ;)

Javas cript is filtered out in game messages and forum posts. bbblues is talking about a different kind of attck.

http://www.bankfotek.pl/view/1101119

Hmm, my Hex rating is not above 2000, but

p5 seems like a completely reasonable move

to me. Maybe your partner wanted to trick you

not to play p5 ???

Ingo (master of 3x3-Hex)

I informed the webmaster about this vulnerability several years ago, and provided a very simple solution. I've not tested to see whether it still works.