Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Line of Death

textslashplain.com

Post reply on HN
Print view View original

91–100 of 108 posts

Re: The Line of Death

#91

Post by ghurtado »

Terr_ wrote: post #78
sgt101 wrote: post #77

Earlier quoted context omitted.

Here's a test; find a six year old, get the six year old to look for stuff on the web. See how confused they are when the search box jumps to the url bar. See how they react to the clickbait and ads that get in the way of every interaction that they have. See how they struggle with dozens of peoples ideas about page layouts and responsiveness. Now, you will say : kids are good at using tech, look they are on x,y & z.…

I believe that "kids these days are good with technology" is a phrase uttered by older people who are actually seeing the kids' willingness to experiment without fear, and assume that it must mean proficiency. Not quite the same thing in the end, though.

> Not quite the same thing in the end, though.

For all intents and purposes, it is. I do not know a single person who I would term "proficient with technology" who is afraid of experimenting or overly concerned about making mistakes when using something new.

In my experience, people who are "good with technology" are always curious hackers and tinkerers who are unafraid of breaking things, and are never satisfied with simply using the tool: they must look under the hood and they must understand how it works.

I would say the same principle applies far beyond computer technology: math, engineering, physics, music, etc...

Re: The Line of Death

#92

Post by xg15 »

> Unfortunately, on windowed operating systems, this is worse than it sounds, because it creates the possibility of picture-in-picture attacks, where an entire browser window, including its trusted pixels, can be faked [...]

They retorted “Well, we passed this screenshot around our entire information security department, and nobody could tell it’s a picture-in-picture attack. Can you?”

Maybe I'm naive, but shouldn't you be able to detect picture-in-picture attacks rather easily because you never opened that window in the first place?

Additionally, the "chrome" of the picture-in-picture would behave significantly than a real chrome.

I feel both of those points can't be assessed by showing people a screenshot, because people have significantly different expectations when looking at a screenshot of a website than when browsing a website by themselves.

Re: The Line of Death

#93

Post by skybrian »

userbinator wrote: post #88
xenadu02 wrote: post #70

Earlier quoted context omitted.

>To fix this the answer is to educate the users That's like saying the fix for road deaths is to educate drivers. We already proved that doesn't work nearly as well as designing better cars, roads, and signs. Educating 7 billion human beings is a lot of work. A mind-bogglingly insane amount of work. Security is even worse because one lapse in judgement, one sick or busy day, can completely erase a lifetime of followi…

Why would we want to make 7 billion people take responsibility for a problem that could be solved by a few thousand programmers? Precisely so that those 7 billion people will not be at the mercy of the few thousand programmers (and those who they represent the interests of.) Creating more walled gardens --- which is effectively what you seem to be proposing --- only gives those in control even more power.

What's the alternative?

Building software is a collective process that often depends on experts. Nowhere is this more clear than in cryptography, which everything else depends on. With hardware it's even worse.

We need to get everything reviewed and decided on in the open, so that independent experts can verify it. But getting rid of experts - forget it, that's a cabin in the woods scenario that doesn't scale.

Of course we can always do more to educate more people, but that's a way of increasing the number of local experts. You're still going to be surrounded by lots of non-programmers who can easily make naive mistakes.

Re: The Line of Death

#94

Post by Senji »

SEMW wrote: post #81
lucideer wrote: post #4

One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers. ... will try and find a screenshot Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a... Edit2: dom0 beat me to it below also Edit3: reword

It's a nice design. But in this particular case, does it matter? What's the threat, that the credentials you enter into a fake basic auth box could be sent to the server? The credentials you enter into a real basic auth box are just sent to the server -- basic auth doesn't do any password hashing clientside. Why would a phishing site (that's pretending to be another site that uses basic auth) fake a basic auth box wh…

Does the real authbox include a domain that's asking?

Re: The Line of Death

#96

Post by ambrop7 »

gumernatorial wrote: post #54

Why can't browsers do image differencing to detect when the page contains something pretending to be the browser or OS chrome, and plaster warnings overtop?

Surely it would have an unacceptable performance impact. Probably you'd need to run the matching in the GPU to get anything remotely useful, and you would literally kill battery life.

Re: The Line of Death

#97

Post by Herrera »

I was playing with picture-in-picture attacks on Chrome some time ago and even proposed a way for mitigation, but it was dismissed.

Here's the PoC I did: https://www.youtube.com/watch?v=0oega6C5SF0

And the mitigation I proposed was from this: http://i.imgur.com/8m6UdiC.png

To this: http://i.imgur.com/turRAdc.png

Re: The Line of Death

#98

Post by syphilis2 »

djsumdog wrote: post #60
bcjordan wrote: post #11

Speaking of zones of death, I was recently the (unsuccessful) target of a credit card gathering scam—on a Twitter ad, pretending to be Twitter . https://twitter.com/bcjordan/status/819894043870105602 Multiple users actually entered their CC #s, two canceled them after they saw my reply to the tweet warning users. Incredibly, Twitter has still not notified the scammed users about it despite removing the ad after my re…

I don't know why you'd need to scam people on Twitter. There are plenty of people who just post photos of their cards: https://twitter.com/needadebitcard

I was pleasantly surprised when my grandmother showed me her new chip credit card and it didn't have the numbers stamped on the front. They're instead printed on the back. I suspect the bank was getting sick of issuing new numbers after people inadvertently posted their own card numbers online.

Re: The Line of Death

#99

Post by jmkni »

djsumdog wrote: post #60
bcjordan wrote: post #11

Speaking of zones of death, I was recently the (unsuccessful) target of a credit card gathering scam—on a Twitter ad, pretending to be Twitter . https://twitter.com/bcjordan/status/819894043870105602 Multiple users actually entered their CC #s, two canceled them after they saw my reply to the tweet warning users. Incredibly, Twitter has still not notified the scammed users about it despite removing the ad after my re…

I don't know why you'd need to scam people on Twitter. There are plenty of people who just post photos of their cards: https://twitter.com/needadebitcard

That's just depressing

Re: The Line of Death

#100

Post by qume »

deathanatos wrote: post #30
qume wrote: post #22

How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area. Also with a buffer so nothing too similar is allowed, or perhaps a warning comes up if something is close. I vote for something like the chrome dinosaur.

Isn't this essentially the lock icon, today? What is "trusted"? We get the lock icon if a valid TLS connection is formed; if you want a more secure connection, you can get EV certificates. We could do away with the lock icon and only show a broken lock if not on TLS, and only show something that looks secure on EV certs, (which seems to be where browsers are headed.) A simple valid TLS connection getting the lock ico…

Pretty much - except the rending engine won't let that block of pixels allow to hit the framebuffer
Post reply on HN