111–120 of 238 posts
"Make sure you’ve done a hard refresh of the page" An inception bar could include a fake refresh button, no?
By "hard refresh" I took that to mean using the keyboard to forcibly reload the page and all assets, e.g. CTRL-F5 on Windows. Of course, the average user probably doesn't use keyboard commands, or even know this one exists.
This wasn't some shady part of the Internet. I was livid.
If they had given it the same name, size, and approximate download speed as the file I was downloading, I would have had zero way to determine this. Everyone has accidentally started two downloads when they just wanted one copy.
Unreal that this could happen on an official site. (And that it basically tricked me.)
I recently helped someone install vlc. I googled VLC download (relying on Google) and then clicked through the clearly labelled download links. I accidentally must have clicked a link twice because two copies started downloading. The more recent one was finished so I literally started opening the executable. The only thing that stopped me was that it was called vlc-streaming or something, and the one next to it was s…
Earlier quoted context omitted.
That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.
Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face. Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.
"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…
In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.
Made me and my friend laugh.
Next session the teacher ask us to sit at the same computer, and after 20mn a guy come to me and ask « Are you pseudo ? »
Turns out that the computers really had viruses and they thought it was me !
They threatened to expel me (more to frighten me I think since they had no proof), and made me the cleaning guy for all the semester.
It gave me an undeserved reputation of the guy who hacked the university computers. And a better sense of caution.
Earlier quoted context omitted.
In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.
Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…
Show a fake login prompt. Write down what gets entered, show wrong password and exit to real prompt.
Earlier quoted context omitted.
That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.
Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face. Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.
On chrome 73.0.3683.90
Using Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear. Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...
- at the top of the page, if I scroll, the address bar disappears;
- as soon as the fake HSBC bar appears, the real address bar comes back;
- both of them remain here until I reload the page.