Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If malware authors ever learn how to spell we're all screwed

hanselman.com

Post reply on HN
Print view View original

31–40 of 106 posts

Re: If malware authors ever learn how to spell we're all screwed

#31

Post by simonbrown »

eridius wrote: post #5
mseebach wrote: post #3

Probably an instance of this? [T]he obvious giveaways are used as a pre-qualifier, to ensure with the least possible effort that the ONLY people who respond to the scammers' initial mass mailings (and therefore have to be brought along individually during the later stages) are the absolutely most gullible, ignorant, susceptible, suckers they can find. http://www.quora.com/Scams/Why-are-email-scams-written-in-br...

I thought that too, but it doesn't apply. This is malware. It doesn't need someone to be gullible beyond the click of the button. Scams, on the other hand, require actually convincing the mark to send money, which is why they need to be sure they have a gullible person on the hook.

It's their button, why would they need the user to click it? I guess it could be clickjacking, but there must be an easier way to do that.

Re: If malware authors ever learn how to spell we're all screwed

#32

Post by recoiledsnake »

tlrobinson wrote: post #22

I forget what the term for it is, but there's a principle that any dialog that's asking the user for credentials or authorization must be clearly delineated from the rest of the UI and thus "unspoofable". The example I recall was a "ribbon" in the OS that slide out to reveal the dialog. If a dialog presented itself but the ribbon remained along the edge you could immediately tell it was spoofed. Of course this requir…

You mean like the Vista and Win 7 UAC screen?

http://www.micro-isv.asia/img/win7uac.png

Re: If malware authors ever learn how to spell we're all screwed

#33

Post by fromhet »

hxa7241 wrote: post #18

Never respond. Always take the initiative. If something asks you about update/downloading/etc., reject it. You decide what to do and when, and you type the URL into the browser, or go to the normal menu/dialog/tool for updating. (This is partly why Chrome browser is right and the normal approach is wrong: if/when it needs update, it just does it.)

That may work for people who think in terms of computer security, but not for the average user who are interested in just using the webapps.

Re: If malware authors ever learn how to spell we're all screwed

#34

Post by simonbrown »

gergles wrote: post #29
arriu wrote: post #16

One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

Any time you need the user to drag their mouse or double-click and don't want selections getting in the way. e.g. drag and drop

Re: If malware authors ever learn how to spell we're all screwed

#35

Post by Karunamon »

Looks like trying to move the "popup" is a great way to defeat this kind of thing for now.

Me: Okay mom, if you ever get a popup that you were not expecting, try to move it outside of the browser before clicking on it. If you can't, it's fake.

Fairly simple, for now.

Re: If malware authors ever learn how to spell we're all screwed

#36

Post by Osmose »

mattmanser wrote: post #13
drzaiusapelord wrote: post #7

The problem is that the people who click on these also have lousy grammar and don't notice, don't care, or won't actually read all of the text. There's only so much we can do if the end user refuses to think. I suspect a lot of these people will be migrating to locked down/walled garden devices soon anyway.

One of the programs I inherited once had been written by a programmer who loved alert boxes of the form 'Are you sure you want to Delete X'. I was watching a user a month or so afterwards to notice they just pressed enter every time an alert box popped up, immediately, without reading and without thought. Alerts on computers aren't there to be read any more. They're confusing annoyances that you just click yes to. Th…

Instead of using alert boxes to confirm that a user wants to perform a destructive operation, you should support undoing the change after it's done, perhaps for a limited time.

Re: If malware authors ever learn how to spell we're all screwed

#37

Post by simonbrown »

arriu wrote: post #16

One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;

But it definitely proves the positive.

Re: If malware authors ever learn how to spell we're all screwed

#38

Post by simonbrown »

its_so_on wrote: post #14
andybak wrote: post #11

In moments of distraction I've had a couple of near-misses where I nearly clicked on malware. But when I'm trying to explain to my dad how to know what to trust and what not to trust I realise it's completely hopeless. You can fake almost everything that a non-techie would know to check.

Ever think to link to a file (e.g. excel spreadsheet) for a forum, like you can for an image with imgur? other than Dropbox public url's the services that exiist have so many images with the word "Download" in the resulting link, all of which look exactly like a UX element, that you have to click about half of them or play Sherlock Holmes to uncover the real download link. It's like a scratch-off lottery.

You could get a hosting account (e.g. NearlyFreeSpeech or S3) and hotlink to them. I guess people don't often intentionally click ads when downloading files, unlike viewing images, so setting up a free file host isn't profitable.

Re: If malware authors ever learn how to spell we're all screwed

#40

Post by RedwoodCity »

malware is a numbers game. All you need is a few thousand older people that don't know any better and you can have your password sniffer / bot net , up and running in no time.

While poorly written english is a red flag to some of us. Not all computer users are native speakers of english even in english speaking countries. They are much less likely to notice usage and spelling errors.

Post reply on HN