41–50 of 106 posts
Scott's right, of course. But to the advantage of the good guys, anybody with the brains and discipline to do a better job of this kind of thing, is much more likely to be able to make a better living honestly, than through fraud and deception.
This reminds me of login spoofing of yesteryear. How do you know if the login prompt on a shared computer or terminal is really from the OS or is a user-level program trying to steal passwords?
The usual solution was to hit a special attention key--like the "break" key under UNIX or Ctrl/Alt/Del for Windows--that user-level programs could not intercept.
Could we use the same idea here? Holding the "break" key will highlight genuine messages from the browser or the OS.
> Should we digitally sign HTML5 apps? Yes. That's better than nothing.
The philosophy of HTML5 seems to be allowing applicants to do a lot of things which don't require much trust to be placed in them (and most applications don't need much), rather than security through asking the user's permission (e.g. most desktop OSs), when they are unlikely to have much idea which developers they should trust, or through accountability/review (e.g. iOS), which adds barriers to entry.
One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;
Why does this parameter exist? What possible legitimate use could you have for disabling selection?
One of the big ideas of the web is selectable content. However UI elements shouldn't be included in this set.
I've written a little more about this (with some screenshots to illustrate my thinking) here: http://blog.dcxn.com/2012/02/29/selectable-elements-are-driv...
The OP's point is that displayed content can be made to be indistinguishable from visual elements of the browser even for technically sophisticated users in the near future. This reminds me of login spoofing of yesteryear. How do you know if the login prompt on a shared computer or terminal is really from the OS or is a user-level program trying to steal passwords? The usual solution was to hit a special attention ke…
It didn't save any passwords or such, just display some random funny non-sense message to the user after s/he inserted login and password and then loop back again to the login prompt with a failed error message.
Even with this obvious message that would warn an alert user for the suspicious terminal, we (my friends and the lab manager) got a few laughs when people coming to the lab and finding all the VT terminals taken would use the PCs to login and tried several (many!) times until giving up, at which point we would tell them the truth. Mind you, these were people comfortable with VT terminals and unix cli and somewhat computer savvy!
Looks like trying to move the "popup" is a great way to defeat this kind of thing for now. Me: Okay mom, if you ever get a popup that you were not expecting, try to move it outside of the browser before clicking on it. If you can't, it's fake. Fairly simple, for now.
Earlier quoted context omitted.
Why does this parameter exist? What possible legitimate use could you have for disabling selection?
I've thought about this quite a bit. As HTML applications continue to evolve we should make them feel "appish". Things like selectable buttons take the user away from experience the app. Also graph labels shouldn't be selectable. One of the big ideas of the web is selectable content. However UI elements shouldn't be included in this set. I've written a little more about this (with some screenshots to illustrate my th…
For example when I install Windows 8 or Mountain lion one of the first prompts I must address is:
"Please choose an image to help you identify
valid system prompts"
"The user decides to use an image of a tiger"
See site key: http://en.wikipedia.org/wiki/SiteKey
The OP's point is that displayed content can be made to be indistinguishable from visual elements of the browser even for technically sophisticated users in the near future. This reminds me of login spoofing of yesteryear. How do you know if the login prompt on a shared computer or terminal is really from the OS or is a user-level program trying to steal passwords? The usual solution was to hit a special attention ke…
See site key: http://en.wikipedia.org/wiki/SiteKey