11–20 of 26 posts
Earlier quoted context omitted.
I'll give you accessibility. I tried changing images in the browser on the fly and it just hides the image. That's probably because the browser would need to make a new GET request.
That's probably a content security policy or CSS thing. Just tried it on a site (not HN, because of content security) and it worked fine.
Earlier quoted context omitted.
That's probably a content security policy or CSS thing. Just tried it on a site (not HN, because of content security) and it worked fine.
I've tried a few different sites and I can't make it happen. I'll keep trying.
Earlier quoted context omitted.
If they already control your browser, they don't have to edit the HTML and fake anything. They can just transfer money to themselves from your account... If they wanted to edit the HTML for some reason, it's trivial to just use their own image or replace the with their own text. The prevention for this isn't to render texts as image, but not to screen share your computer with random people online, much less hand mous…
If you're interested, I would suggest watching some Kitboga. I don't actually know anyone that has had this happen but there are plenty of stories around the internet. I will try doing some img replacement with my own text and see how it works out.
But I don't think the fix for that is for banks to change how they render text. Users can get fooled with just a few IMs. I know people who lost thousands to Zelle/Cash app scams purely over Craigslist emails or messages that way...
Making banks render text as images won't magically fix that. Especially since many people these days use phone apps instead of browsers for banking anyway.
Earlier quoted context omitted.
I'll give you accessibility. I tried changing images in the browser on the fly and it just hides the image. That's probably because the browser would need to make a new GET request.
That's probably a content security policy or CSS thing. Just tried it on a site (not HN, because of content security) and it worked fine.
Earlier quoted context omitted.
That's probably a content security policy or CSS thing. Just tried it on a site (not HN, because of content security) and it worked fine.
Wouldn't banks have content security setup?
Edit: Just tried it with Chase, Merrill Lynch, Citibank, Bank of America, and Wells Fargo. Only Wells Fargo had a CSP in place to prevent this. But even Walls Fargo let you just inject a data URL image.
Earlier quoted context omitted.
They ask a person to login to their bank account with screen sharing. They then take control of the mouse and edit the HTML on the fly making it look like they transferred a large amount to the bank account. Now they ask the person to wire money back or they will lose their job.
If they already control your browser, they don't have to edit the HTML and fake anything. They can just transfer money to themselves from your account... If they wanted to edit the HTML for some reason, it's trivial to just use their own image or replace the with their own text. The prevention for this isn't to render texts as image, but not to screen share your computer with random people online, much less hand mous…
In the scam they pretend to make a refund to the victim where the victim has to put in the refund amount, the scammer, that has access to the pc via remote control then adds a 0 to the amount and pretends the victim has entered the incorrect amount. That input was just in the windows CMD and did not send any money. The scammer now will talk about that he lose his job because the company has lost a lot of money. The scammer than wants the money back via gift cards. (Because gift cards cant be tracked or refund)
Finally, text makes web scraping/parsing much easier, and even ignoring that text is smaller than any image format.
Probably accessibility reasons. Even ancient browsers or obscure browsers support text. Their is a non zero chance a browser wouldn't support the image format, or the image might not scale across different screen sizes. Also iirc their was some vulnerability that used a image format so that's also a issue to think about. Finally, text makes web scraping/parsing much easier, and even ignoring that text is smaller than…
Web scrapping shouldn't be a requirement of personal banking websites. Am I missing something here?
They will also likely just come up with a small tweak on the scam if there is a change like this. I’ve watched some of the videos where they pull up a command prompt and run a script where the user is entering the amount to transfer into the CLI. When they type the amount the scammer slips in an extra 0 before the user presses enter. If someone is going to fall for entering their info into a strange black box with text, they will fall for literally anything. The scammer could simply delete the image on the page so the balance doesn’t show and say there is a bug… or delete the image and replace it with text, even if it looks off, the type of person being targeted won’t catch it.
I often login to my bank to copy an account number when I need it. I don’t like to rely on typing it correctly. This change would kill that. Sure, I could use OCR on the image, but that isn’t 100% perfect, like a text copy is. They will also likely just come up with a small tweak on the scam if there is a change like this. I’ve watched some of the videos where they pull up a command prompt and run a script where the…
The harder we make it for scammers, the worse it is for them. I'm not claiming this is fool proof - scammers might be able to generate a png on the fly and inject that as the image like solrdev mentioned in another comment. They would still need to match background colors or possibly jump through some other hoops. The more work we make them do, the more likely the are to mess up. It also makes it more obvious to the person being scammed.
In terms of deleting the image and inserting text instead, I've tried it and it's hard to make it look good quickly. You also see instant feedback of the missing element and then the text coming in. It's a cue that something isn't quite right.