Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

zdnet.com

Post reply on HN
Print view View original

51–60 of 82 posts

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#51

Post by st3fan »

microcolonel wrote: post #8

I say it every time that people say "Firefox is great now!". Just look at the Bugzilla, and tell me that among the thousands of reports (many of which have gone untriaged for around a decade!) there aren't at least a handful of serious issues like this. One, among many, of the reasons I use Chromium is that I see reports taken absolutely seriously, especially any report with any potential security outcome. Even seemi…

Every browser is like this. Browse the WebKit or Chromium bug trackers and you will see the exact same: thousands of issues - these are all large projects with a backlog.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#52

Post by franga2000 »

Santosh83 wrote: post #43
codedokode wrote: post #40

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that br…

> Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. What possible justification is there for this? Looks like this can become an ideal way to…

> What possible justification is there for this?

If I had to guess, I'd say games. Browser games just refuse to die. I thought they'd die with Java applets, then with Flash, but they just keep coming back...

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#53

Post by tinus_hn »

codedokode wrote: post #40

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that br…

I also saw one with an offset custom mouse cursor so you can’t trust what you’re clicking on.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#54

Post by codedokode »

Santosh83 wrote: post #43
codedokode wrote: post #40

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that br…

> Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. What possible justification is there for this? Looks like this can become an ideal way to…

The spec [1] says:

> Richly interactive web sites, games and remote desktop/application streaming experiences want to provide an immersive, full screen experience. To accomplish this, sites need access to special keys and keyboard shortcuts while they are in full screen mode so that they can be used for navigation, menus or gaming functionality.

But I guess it will be used by scammers as well.

[1] https://w3c.github.io/keyboard-lock/#introduction

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#55

Post by crysin »

franga2000 wrote: post #52
Santosh83 wrote: post #43

Earlier quoted context omitted.

> Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. What possible justification is there for this? Looks like this can become an ideal way to…

> What possible justification is there for this? If I had to guess, I'd say games. Browser games just refuse to die. I thought they'd die with Java applets, then with Flash, but they just keep coming back...

Why the language of refuse? Are you inferring there is inherently something bad about games on the web?

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#56

Post by codedokode »

tinus_hn wrote: post #53
codedokode wrote: post #40

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that br…

I also saw one with an offset custom mouse cursor so you can’t trust what you’re clicking on.

Also such sites sometimes play audio instructions trying to scare or deceive a user.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#57

Post by SilasX »

st3fan wrote: post #50
SilasX wrote: post #45

Earlier quoted context omitted.

Not to defend Mozilla's inability to prioritize , but ... Isn't that a common issue across browsers? I know on iOS, I get burned by shady sites on Safari that do redirects and pop up a browser-level modal that somehow stops me from closing the tab until I turn off Javascript and restart the browser.

That must be on an older iOS version? Pretty sure that on recent versions the modal dialogs are actually not modal anymore and are rendered 'in content'. So you can always close the tab.

11.2.1. But I guess in tech, that's the wild-west stone age where you couldn't expect a browser not to be taken over by a site ...

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#58

Post by AnIdiotOnTheNet »

Santosh83 wrote: post #43
codedokode wrote: post #40

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that br…

> Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. What possible justification is there for this? Looks like this can become an ideal way to…

People increasingly trying to turn the web into an application layer instead of writing actual applications.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#59

Post by franga2000 »

crysin wrote: post #55
franga2000 wrote: post #52

Earlier quoted context omitted.

> What possible justification is there for this? If I had to guess, I'd say games. Browser games just refuse to die. I thought they'd die with Java applets, then with Flash, but they just keep coming back...

Why the language of refuse? Are you inferring there is inherently something bad about games on the web?

No, that's just my opinion.

One of the main reasons wouldn't like to see browser games come back is that they are usually basically 100% tied to a server. They're not like standard games, where even if the servers go down, you still have the files and can either keep playing offline or even hack together a server implementation. Once the server goes down, that game is gone[1].

Not to mention, that if an industry were to arise around web-based games, most would probably either be the "free but pay-to-win and with ads" kind, or on Netflix-style subscription platforms where you don't actually own anything and you're just paying for the access.

[1] - not saying it's impossible to preserve it, just that it's not preserved by default, like a locally-installed game is

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#60

Post by fl0wenol »

_fbpt wrote: post #20
pmoriarty wrote: post #2

Yet another reason to use an extension like uMatrix to disallow javascript by default, and only allow the absolute minimum that sites you trust need to function.

This dialog seems to operates off HTTP authentication, so disabling Javascript will probably not prevent it from appearing.

Not probably, but definitely. HTTP auth modal dialogs are a pre-Javascript feature from the earliest Netscape versions.
Post reply on HN