Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Line of Death

textslashplain.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: The Line of Death

#81

Post by SEMW »

lucideer wrote: post #4

One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers. ... will try and find a screenshot Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a... Edit2: dom0 beat me to it below also Edit3: reword

It's a nice design. But in this particular case, does it matter? What's the threat, that the credentials you enter into a fake basic auth box could be sent to the server? The credentials you enter into a real basic auth box are just sent to the server -- basic auth doesn't do any password hashing clientside. Why would a phishing site (that's pretending to be another site that uses basic auth) fake a basic auth box when they could just send the right header and get a real one?

What am I missing?

Re: The Line of Death

#82

Post by cel1ne »

userbinator wrote: post #23
yosefk wrote: post #15

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…

> To fix this the answer is to educate the users.

Impossible.

The way to improve is to restrict the amount of damage that can be done by spoofed websites and have multiple safe-guards in place.

People cannot be expected to learn these technicalities. If they get a phone call, on the other hand, and are asked whether they really intended to make a large purchase that raised a flag somewhere, they will know what to say.

Re: The Line of Death

#83

Post by dom0 »

DCoder wrote: post #76
niftich wrote: post #18

Earlier quoted context omitted.

I still disagree with both lucideer's original and improved wording, but I agree with their message, which praises Opera's basic auth UI as making it clear with the borders and 3D foreground overlay effect that it's a part of the browser-produced "trusted zone", and not the pool of untrusted content behind. Moreover, these kinds of UIs are still possible with the 'flat' look that's in vogue today, so there's little e…

> one reason is that basic auth lost out early on to site-supplied login forms, so people got used to entering usernames and passwords into the page content anyway, instead of the browser UI To be fair, basic auth is not particularly user-friendly. If you want to add anything else to the login form, such as a "Remember Me" checkbox or a captcha, you can't put that in the browser chrome, you need to add an additional…

Basic auth is appropriate mostly for non-Internet or single-user applications. It is eg. commonly used as a simple-no-markup-required input where actual authentication is delegated to LDAP/AD. In these instances the application can neither change the password nor create users anyway.

Re: The Line of Death

#84

Post by vanderZwan »

grenoire wrote: post #2

From a few weeks ago: https://twitter.com/tomscott/status/812265182646927361 This is a neat blog post that goes to show the extents of faking that can be done in the browser. More talks about this will hopefully lead to better "security UI" as the author puts it.

I have my browser default to non-standard zoom (150%). Assuming the fake attachments use a jpg instead of an SVG, they would look different. Not to mention miss the on-hover CSS. I wonder if I would notice it or not; something would probably feel off but not enough to fully register.

Re: The Line of Death

#85

Post by throwawayish »

notriddle wrote: post #69
Stratoscope wrote: post #43

Earlier quoted context omitted.

That problem is easily solved. In your malware, simply use the default settings for all of those things, and you will catch the 97% of users who never customize any of it. You can afford to lose the remaining 3%.

The title bar thing, yes. The accent color? If you buy a new Windows 10 machine off the shelf, after you enter your name, it asks what your favorite color is. I think blue is highlighted when that screen comes up, but you can't miss the opportunity, so 3% is a bit low for an estimate of how many people will change it.

Favourite colors don't follow a random distribution. IIRC with blue and green you already have two thirds of the population.

Re: The Line of Death

#86

Post by TeMPOraL »

Terr_ wrote: post #78
sgt101 wrote: post #77

Earlier quoted context omitted.

Here's a test; find a six year old, get the six year old to look for stuff on the web. See how confused they are when the search box jumps to the url bar. See how they react to the clickbait and ads that get in the way of every interaction that they have. See how they struggle with dozens of peoples ideas about page layouts and responsiveness. Now, you will say : kids are good at using tech, look they are on x,y & z.…

I believe that "kids these days are good with technology" is a phrase uttered by older people who are actually seeing the kids' willingness to experiment without fear, and assume that it must mean proficiency. Not quite the same thing in the end, though.

One leads to the other; if said older people would be less afraid to experiment, they'd learn things as quickly and they'd too become proficient.

Re: The Line of Death

#87

Post by schlowmo »

TeMPOraL wrote: post #86
Terr_ wrote: post #78

Earlier quoted context omitted.

I believe that "kids these days are good with technology" is a phrase uttered by older people who are actually seeing the kids' willingness to experiment without fear, and assume that it must mean proficiency. Not quite the same thing in the end, though.

One leads to the other; if said older people would be less afraid to experiment, they'd learn things as quickly and they'd too become proficient.

While this is basically true, there is also the difficulty to teach less tech-savvy where it's save to experiment and where not. (And this is where things like "The Line of Death" come into play.)

Anectdotal example: On one hand I sometimes get almost mad when I try to help my parents with computer problems (especially via phone) because they didn't even bothered with randomly trying somewhat problem-related buttons or options.[0] They just get paralyzed (by the fear they could break something) because something happens what isn't routine, even if the solution could be found within minutes even by non tech people.

On the other hand I'm glad about the same behaviour when they call me to ask if some mail or website is legitimate or not. About half of the calls are false positive scam suspicions, but I'm happy looking into them, as long it helps them not getting scammed.

[0] https://xkcd.com/627/

Re: The Line of Death

#88

Post by userbinator »

xenadu02 wrote: post #70
userbinator wrote: post #23

Earlier quoted context omitted.

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…

>To fix this the answer is to educate the users That's like saying the fix for road deaths is to educate drivers. We already proved that doesn't work nearly as well as designing better cars, roads, and signs. Educating 7 billion human beings is a lot of work. A mind-bogglingly insane amount of work. Security is even worse because one lapse in judgement, one sick or busy day, can completely erase a lifetime of followi…

Why would we want to make 7 billion people take responsibility for a problem that could be solved by a few thousand programmers?

Precisely so that those 7 billion people will not be at the mercy of the few thousand programmers (and those who they represent the interests of.) Creating more walled gardens --- which is effectively what you seem to be proposing --- only gives those in control even more power.

Re: The Line of Death

#89

Post by slobotron »

userbinator wrote: post #26
dsr_ wrote: post #16

Earlier quoted context omitted.

Here's one: don't use the default window manager theme. This is much easier on Linux and *BSD than in Windows or MacOS. I've seen lots of picture-in-picture attacks. They usually simulate Windows title bars and controls. Hah. I once saw one on a Mac which adapted to the OS and tried to show a Mac window frame, but it was an outdated version. That brings me to another point: send an incorrect User-Agent. Same browser…

It used to be pretty easy to customise appearance on Windows, but the latest versions seem to have mostly castrated that functionality.

Would you say that castrating window decorations was a misguided attempt by Microsoft to make Windows more like eunuchs?

(I'll let myself out)

Re: The Line of Death

#90

Post by notriddle »

throwawayish wrote: post #85
notriddle wrote: post #69

Earlier quoted context omitted.

The title bar thing, yes. The accent color? If you buy a new Windows 10 machine off the shelf, after you enter your name, it asks what your favorite color is. I think blue is highlighted when that screen comes up, but you can't miss the opportunity, so 3% is a bit low for an estimate of how many people will change it.

Favourite colors don't follow a random distribution. IIRC with blue and green you already have two thirds of the population.

A browser ad that imitates a windows dialog can only guess one color per impression. Forcing Mallory to settle for 1/3 of the otherwise-vulnerable population is a definite improvement.
Post reply on HN