I concur re CSRF, fwiw. I’ve always thought of it as a form of remote (albeit blind) hijacking. The attacker is essentially duping the browser into allowing the attacker’s actions to be taken — with the trust (and session tokens) of the local user. To me, that sure sounds like hijacking, not interposition.

Re black box being what clients are willing to pay for, I’ve witnessed the same, and for many years. But we’ve all been claiming this to be “a start” for far too long. We’ve all got to move beyond that. We’ve got to do our best to convince and educate of the value of doing serious security testing beyond the uninformed black box sort. IMHO…

Cheers,

Ken van Wyk