Everything looks correct on chrome mobile. I don't ever see the HSBC bar, regardless of how I scroll.
The number of opened pages is not, especially if it is :D
The inception bar: a new phishing method
21–30 of 238 posts
Re: The inception bar: a new phishing method
#22Not using Chrome, and not having a padlock in the URL bar, and disabling non-ASCII URLs, fixes many of this problem. Another possibility would be to display a "collapsed" address bar, so that you can see that it is not the actual bar, but rather is another one.
Mobile safari does the collapsed address bar.
Re: The inception bar: a new phishing method
#23Not using Chrome, and not having a padlock in the URL bar, and disabling non-ASCII URLs, fixes many of this problem. Another possibility would be to display a "collapsed" address bar, so that you can see that it is not the actual bar, but rather is another one.
IMO, the collapsed address bar is the most pragmatic fix to this issue. (The other fixes are options that users would have to opt in to, rather than being fixed at the source - i.e. Chrome.)
Re: The inception bar: a new phishing method
#24Related: https://feross.org/html5-fullscreen-api-attack/
Cool - this attack is perhaps worse! Fullscreen should require a more explicit permission dialog, like webcam access, web push notifications, etc.
At least on my computer there is a permission dialog for the fullscreen API. However, if document scripting is disabled (which is what I have by default anyways) then the link does not do those stuff. (I also use an unusual window layout, so if someone tries to spoof the window layout, it is likely that I can easily see the problem immediately anyways.)
Re: The inception bar: a new phishing method
#25Doesn't seem to work with Firefox on Android but a nifty little trick for sure!
Re: The inception bar: a new phishing method
#26This sort of works on chrome Android, but the critical overflow:hidden trick does not prevent chrome from restoring the real address bar.
Re: The inception bar: a new phishing method
#27I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.
Re: The inception bar: a new phishing method
#28Using Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear.
Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...
Re: The inception bar: a new phishing method
#29I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.
In principle, it's not a mitigation - I was just too lazy to forge an interactive URL bar! You could make one which acts just like the Chrome URL bar, but e.g. acts as a MITM.
Re: The inception bar: a new phishing method
#30Poor Android users .. no blue bubbles and now this!