This is a truly dark pattern.
https://textplain.files.wordpress.com/2017/01/image38.png?w=...
Faking browser popups is evil, and unexpected for a high-profile site such as Tom's Hardware.
The Line of Death
31–40 of 108 posts
Re: The Line of Death
#32Earlier quoted context omitted.
To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…
Back when it was still possible (Windows XP? Maybe Windows 7?) I would always turn off all the modern Windows chrome and animation and make it look like Windows 2000. Made for better responsiveness and as you say, you could spot fake dialog boxes in an instant. Not a Windows user these days but I understand it's not possible to get the old Windows 2000 look anymore, though I'm sure you can still change color themes a…
You can still do this as late as Win7. I think this was eliminated in Win8, but I've not used it myself.
If you do use Aero, you can change the window chrome colour to something custom, which should catch out sites trying to fake windows. I don't think browsers provide any way to get the window chrome colour, though come to think of it, I'm fairly sure IE does/used to provide system colour names in CSS, so it might not be impossible... (If you recall the Win2000-era colour customization window, which IIRC you can still access in current versions of Windows, it's just hidden, you can set things like default window background colour, which traditionally in the Win2000 era was grey. So I guess the idea is that websites could use these system colours if you changed them to be consistent with the OS. Of course nobody really does this.)
Re: The Line of Death
#33This is a truly dark pattern. https://textplain.files.wordpress.com/2017/01/image38.png?w=... Faking browser popups is evil, and unexpected for a high-profile site such as Tom's Hardware.
What exactly does it accomplish, though, in this instance? Since it's not real it can't actually authorize anything the site can't already do. It's a dubious approach, but it seems more misguided than actively malicious.
Re: The Line of Death
#34Occurs to me that counteracting this problem might be one of the strengths of 3D UIs, such as we might have to look forward to in AR systems, or with display advances. Untrusted content can literally be loaded up and restricted to exist only 'inside' a chrome box, making its provenance clear.
Of course, chances are that we'll get carried away with the possibilities of allowing AR web browsers to create arbitrary objects in the AR space long before we realize what a terrible idea that is...
Re: The Line of Death
#35I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…
All these browsers have that darn Modal dialog alert that lets the code below the line of death trap you on their site. Definitely a disconnect with the plight of their users.
Re: The Line of Death
#36This is a truly dark pattern. https://textplain.files.wordpress.com/2017/01/image38.png?w=... Faking browser popups is evil, and unexpected for a high-profile site such as Tom's Hardware.
What exactly does it accomplish, though, in this instance? Since it's not real it can't actually authorize anything the site can't already do. It's a dubious approach, but it seems more misguided than actively malicious.
If they say no to the real thing, the site can't ask again. But of course they can present the fake one on every page as many times as they want until the user acquiesces. So once they click "yes" on the mini dialog, the page opens the real permissions dialog, because you can be much more certain that they'll allow it.
Good TC article on the practice: https://techcrunch.com/2014/04/04/the-right-way-to-ask-users...
Re: The Line of Death
#37How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area. Also with a buffer so nothing too similar is allowed, or perhaps a warning comes up if something is close. I vote for something like the chrome dinosaur.
> How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area.
So in the blogpost announcing this distinctive icon, what does the screenshot look like?
Re: The Line of Death
#38Earlier quoted context omitted.
Back when it was still possible (Windows XP? Maybe Windows 7?) I would always turn off all the modern Windows chrome and animation and make it look like Windows 2000. Made for better responsiveness and as you say, you could spot fake dialog boxes in an instant. Not a Windows user these days but I understand it's not possible to get the old Windows 2000 look anymore, though I'm sure you can still change color themes a…
You can still do this as late as Win7. I think this was eliminated in Win8, but I've not used it myself. If you do use Aero, you can change the window chrome colour to something custom, which should catch out sites trying to fake windows. I don't think browsers provide any way to get the window chrome colour, though come to think of it, I'm fairly sure IE does/used to provide system colour names in CSS, so it might n…
Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?).
Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.
Re: The Line of Death
#39An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.
I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh | sh' or something, where if you pipe it to cat instead, it looks harmless enough, because it contains control characters that erase the dangerous parts. So you have to download the script, and load it up in an editor before you can see what it actually does.
...which of course is so much work that noone does it.
Re: The Line of Death
#40I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…
All these browsers have that darn Modal dialog alert that lets the code below the line of death trap you on their site. Definitely a disconnect with the plight of their users.
After the first pop-up Chrome and Firefox let you say "block all the dialogs from this site from now on."