The Line of Death • Hacker News Board

Re: The Line of Death

#11

Post by bcjordan » Sat, Jan 14, 2017, 10:10 PM UTC

Speaking of zones of death, I was recently the (unsuccessful) target of a credit card gathering scam—on a Twitter ad, pretending to be Twitter.

https://twitter.com/bcjordan/status/819894043870105602

Multiple users actually entered their CC #s, two canceled them after they saw my reply to the tweet warning users.

Incredibly, Twitter has still not notified the scammed users about it despite removing the ad after my report and multiple tweets to support requesting they notify the affected users.

The fact that they allowed that ad to get through (essentially profiting from users identities and financial information being leaked?!) is just unbelievable, separate from their failure to protect/notify the users affected by the scam.

Re: The Line of Death

#12

Post by throwawayish » Sat, Jan 14, 2017, 10:18 PM UTC

An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.

Re: The Line of Death

#13

Post by grenoire » Sat, Jan 14, 2017, 10:19 PM UTC

lucideer wrote: post #8

grenoire wrote: post #7

Earlier quoted context omitted.

Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.

Sorry, perhaps my comment was unclear. I meant "breaking" in a positive way (hence "best") - the UI crossed the line in a very significant and impossible-not-to-notice way. Still searching for a screenshot unfortunately... may just re-install it and take one myself.

dom0's comment showed what you meant. That's a much better auth dialog.

Re: The Line of Death

#14

Post by greenrd » Sat, Jan 14, 2017, 10:25 PM UTC

throwawayish wrote: post #12

An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.

You can't embed control characters in URLs, though. Of course some web servers and web applications may blithely accept illegal unescaped control characters in URLs. If so, they're buggy.

Re: The Line of Death

#15

Post by yosefk » Sat, Jan 14, 2017, 10:27 PM UTC

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or the basic fact that different pixels are drawn by different programs, not to mention URL structure, or (gasp) Unicode and how it fits there, or how rnicrosoft.com isn't what they're looking for? What makes them understand this? Nothing. Software vendors are very happy with uninformed users (in fact these are the best users because they don't realize which of your programs and services can be replaced with an alternative and how), and users are very happy to stay uninformed, too.

Not saying I know how to fix this, just that in my experience non-tech people are so completely unaware of what's going on that this "line of death" thing is not even a thing for them.

Re: The Line of Death

#16

Post by dsr_ » Sat, Jan 14, 2017, 10:31 PM UTC

ensignavenger wrote: post #6

It would be helpful if this post included mentions or links to any best practices to help mitigate this. Does anyone have any they would like to share?

Here's one: don't use the default window manager theme. This is much easier on Linux and *BSD than in Windows or MacOS.

I've seen lots of picture-in-picture attacks. They usually simulate Windows title bars and controls. Hah. I once saw one on a Mac which adapted to the OS and tried to show a Mac window frame, but it was an outdated version.

That brings me to another point: send an incorrect User-Agent. Same browser on a different OS, perhaps.

Re: The Line of Death

#17

Post by throwawayish » Sat, Jan 14, 2017, 10:44 PM UTC

greenrd wrote: post #14

throwawayish wrote: post #12

An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.

You can't embed control characters in URLs, though. Of course some web servers and web applications may blithely accept illegal unescaped control characters in URLs. If so, they're buggy.

    if invalid(input):
      log.warning('UberForm field wrong: ' + input)

(And many subtle variations thereof)

Re: The Line of Death

#18

Post by niftich » Sat, Jan 14, 2017, 10:59 PM UTC

dom0 wrote: post #10

lucideer wrote: post #8

Earlier quoted context omitted.

Sorry, perhaps my comment was unclear. I meant "breaking" in a positive way (hence "best") - the UI crossed the line in a very significant and impossible-not-to-notice way. Still searching for a screenshot unfortunately... may just re-install it and take one myself.

http://schubiserv.de/images/opera-benutzerauthentifizierung....

I still disagree with both lucideer's original and improved wording, but I agree with their message, which praises Opera's basic auth UI as making it clear with the borders and 3D foreground overlay effect that it's a part of the browser-produced "trusted zone", and not the pool of untrusted content behind.

Moreover, these kinds of UIs are still possible with the 'flat' look that's in vogue today, so there's little excuse why others choose not to do it. Perhaps one reason is that basic auth lost out early on to site-supplied login forms, so people got used to entering usernames and passwords into the page content anyway, instead of the browser UI.

For the most part, basic auth only tends to affect uses like intranet sites, router login pages, web services, remote management pages -- settings where phishing can still cause (serious) damage, so a harder-to-fake UI would be beneficial nonetheless.

Re: The Line of Death

#19

Post by franciscop » Sat, Jan 14, 2017, 11:01 PM UTC

I have found a much worse case in mobile apps. I do not have Facebook App installed, so I get a prompt from some apps when I try to auth through facebook in-app to login into facebook, which could be totally fake.

Re: The Line of Death

#20

Post by kibwen » Sat, Jan 14, 2017, 11:01 PM UTC

I've never heard the term "line of death" used to describe this before, but this concept is exactly why I've sadly convinced myself that fully chromeless browsers are a bad idea. Unless there were some sort of spoofless hardware indicator that a given UI element was being displayed by the browser, I suppose... but that sort of defeats the purpose.