41–50 of 108 posts
Earlier quoted context omitted.
All these browsers have that darn Modal dialog alert that lets the code below the line of death trap you on their site. Definitely a disconnect with the plight of their users.
After the first pop-up Chrome and Firefox let you say "block all the dialogs from this site from now on."
An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.
I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh | sh' or something, where if you pipe it to cat instead, it looks harmless enough, because it contains control characters that erase the dangerous parts. So you have to download the script, and load it up in an editor before you can see what it actually does. ...which of course is so much work that noone doe…
Earlier quoted context omitted.
You can still do this as late as Win7. I think this was eliminated in Win8, but I've not used it myself. If you do use Aero, you can change the window chrome colour to something custom, which should catch out sites trying to fake windows. I don't think browsers provide any way to get the window chrome colour, though come to think of it, I'm fairly sure IE does/used to provide system colour names in CSS, so it might n…
Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?). Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.
You can afford to lose the remaining 3%.
I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…
Could this also apply to the WhatsApp "backdoor" thread from yesterday?
Earlier quoted context omitted.
To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…
>>To fix this the answer is to educate the users I used to believe this too. Over the past several years though, I've worked with many, many users from all walks of life, and I've come to realize the hard truth: the users simply don't give a shit. They already use a billion other apps in their day-to-day work and don't have time to spend watching training videos or reading documentation. So if they have to be educate…
The user is the boss of the software. The user is not a peripheral that I get to reprogram. I must accept the user as is, and adapt as best as possible to their actual capabilities.
https://www.google.com/search?q=bsod+scam+site&num=100&prmd=...
Even when people see a scam where the UI obviously doesn't match with the OS, ignorant non technical people fall for it. People get those scam sites in safari on OSX and still click and pay.
An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.
I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh | sh' or something, where if you pipe it to cat instead, it looks harmless enough, because it contains control characters that erase the dangerous parts. So you have to download the script, and load it up in an editor before you can see what it actually does. ...which of course is so much work that noone doe…
If you're opening it in a browser to check, you've also got to worry that the server may be looking at curl's user agent to decide whether to serve up a malicious payload[1].
[0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... [1] https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...
Earlier quoted context omitted.
After the first pop-up Chrome and Firefox let you say "block all the dialogs from this site from now on."
I have not seen that consistently, maybe there is a bug. Also the trick works for basic auth and I don't think they have addressed that yet?
One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers. ... will try and find a screenshot Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a... Edit2: dom0 beat me to it below also Edit3: reword
Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
And Firefox greys out some browser chrome: https://i.imgur.com/JfJ57qA.gif
But these things are probably not going to be noticed by your average user...
