It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.
Cursor:none abuse (trick users into clicking Facebook 'like')
11–20 of 69 posts
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#12This is brilliant, but now it's only a matter of time until it's in actual use. Sort of like how evercookie was a clever hack meant to call attention to privacy concerns, then was put into actual production sites.
Do you have any examples of sites/companies that put the techniques into use as a direct result of Evercookie exposing them?
EDIT: Why am I being downvoted for this question? I am seriously interested, so that I can avoid contact with them.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#13Interesting. Chrome's "Under the Hood > Content Settings > Mouse Cursor" setting doesn't affect this. I would have thought it would prevent this. Also, stuff like this is why we can't have nice things in browsers. You can't trust the internet.
Given what we've been seeing with attack sites, whether shock sites trying to just DoS the browser or silly tricks like making the browser POST to an irc server's irc port to spread the malicious URL, or just terrible ads and tracking that actively slow down the browser and ruin the surfing experience, I'm amazed that not more people see javascript as a built-in remote code execution vulnerability that only gains mor…
"...and letting me consume videos and stuff in a trusted media player plugin."
HTML5 generally solves this with and . If implemented correctly by browsers, they should not require any scripting on the site itself to work.
That said, "trusted" media player plugins (think Flash) have been the targets of many successful attacks as well.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#14This is brilliant, but now it's only a matter of time until it's in actual use. Sort of like how evercookie was a clever hack meant to call attention to privacy concerns, then was put into actual production sites.
Do you have any examples of sites/companies that put the techniques into use as a direct result of Evercookie exposing them? EDIT: Why am I being downvoted for this question? I am seriously interested, so that I can avoid contact with them.
[deleted]
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#15It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.
What website is useable these days though without Javascript?
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#16Interesting. Chrome's "Under the Hood > Content Settings > Mouse Cursor" setting doesn't affect this. I would have thought it would prevent this. Also, stuff like this is why we can't have nice things in browsers. You can't trust the internet.
Given what we've been seeing with attack sites, whether shock sites trying to just DoS the browser or silly tricks like making the browser POST to an irc server's irc port to spread the malicious URL, or just terrible ads and tracking that actively slow down the browser and ruin the surfing experience, I'm amazed that not more people see javascript as a built-in remote code execution vulnerability that only gains mor…
Given that vein of thought you can't really trust any software
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#17It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.
What website is useable these days though without Javascript?
Few of the popular ones, but there may be some misconception here. NoScript isn't meant to be blocking JavaScript for all sites. If you trust a site, which doesn't function without JavaScript, adding it to the whitelist is one click away. You get used to it quickly.
And, even in the mode where JavaScript is allowed by default on new sites, the other protections (Clickjacking, XSS, ABE, etc) still apply.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#18[deleted]
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#19It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.
What website is useable these days though without Javascript?
Hacker News, for one. Anyway, NoScript isn't an extension to disable javascript (there's already a checkbox for that), the point is to selectively enable it.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#20This is brilliant, but now it's only a matter of time until it's in actual use. Sort of like how evercookie was a clever hack meant to call attention to privacy concerns, then was put into actual production sites.
Do you have any examples of sites/companies that put the techniques into use as a direct result of Evercookie exposing them? EDIT: Why am I being downvoted for this question? I am seriously interested, so that I can avoid contact with them.
I'm not sure if you can say that it's a direct result of Evercookie, but a number of high profile sites use this kind of tech - for example KissMetrics.com is used by a number of big companies, and they use ETAG cookies, Flash cookies - the lot.