The Line of Death
textslashplain.com
The Line of Death
1–10 of 108 posts
Re: The Line of Death
#2From a few weeks ago:
https://twitter.com/tomscott/status/812265182646927361
This is a neat blog post that goes to show the extents of faking that can be done in the browser. More talks about this will hopefully lead to better "security UI" as the author puts it.
Re: The Line of Death
#3With HTML5 push state navigation, can we really trust the address bar? Or is the domain part protected from that?
Re: The Line of Death
#4One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers.
... will try and find a screenshot
Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a...
Edit2: dom0 beat me to it below also
Edit3: reword
Re: The Line of Death
#5With HTML5 push state navigation, can we really trust the address bar? Or is the domain part protected from that?
The domain part is protected from that, though as shown in grenoire's link there are other reasons to distrust the address bar.
Re: The Line of Death
#6It would be helpful if this post included mentions or links to any best practices to help mitigate this. Does anyone have any they would like to share?
Re: The Line of Death
#7One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers. ... will try and find a screenshot Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a... Edit2: dom0 beat me to it below also Edit3: reword
Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
Re: The Line of Death
#8One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers. ... will try and find a screenshot Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a... Edit2: dom0 beat me to it below also Edit3: reword
Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
Sorry, perhaps my comment was unclear. I meant "breaking" in a positive way (hence "best") - the UI crossed the line in a very significant and impossible-not-to-notice way.
Still searching for a screenshot unfortunately... may just re-install it and take one myself.
Re: The Line of Death
#9This is an interesting case where security and design are in direct collision. From a security perspective you'd want the demarcation between the application itself and the untrusted content area to be as clear and obvious as possible, which would mean drawing big borders between them so thick nobody could possibly miss them. But contemporary design is all about being "clean," part of which involves making borders razor thin and so lightly colored you can barely see them.
The example given of Chrome's line-of-death-crossing chevron is a good illustration of this tension. Say what you want to about it security-wise, but you can't say it's not clean!
Re: The Line of Death
#10Earlier quoted context omitted.
Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
Sorry, perhaps my comment was unclear. I meant "breaking" in a positive way (hence "best") - the UI crossed the line in a very significant and impossible-not-to-notice way. Still searching for a screenshot unfortunately... may just re-install it and take one myself.
