Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If malware authors ever learn how to spell we're all screwed

hanselman.com

Post reply on HN
Print view View original

51–60 of 106 posts

Re: If malware authors ever learn how to spell we're all screwed

#51

Post by kht786 »

csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Enough users will end up using certain images such as the tiger making it worthwhile to fake a prompt.

Re: If malware authors ever learn how to spell we're all screwed

#52

Post by astral303 »

csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Tech savvy users are not the main problem in malware.

The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site?

Think of how many things can go wrong on a computer. Think of every time when someone asked you why something works one way in this situation, but another way in another situation, and you had to use a technical explanation (excuse, really) for that inconsistency. Computing is full of that. Until we get to a place where people can actually TRUST and expect consistent behavior in their computing devices, the SiteKey/tiger will be well circumventable.

As far as I'm concerned, SiteKey is a brilliant business idea for selling to satisfy the regulatory two-factor requirement, but a terrible idea in practice.

Re: If malware authors ever learn how to spell we're all screwed

#53

Post by kalleboo »

nixterrimus wrote: post #44
gergles wrote: post #29

Earlier quoted context omitted.

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

I've thought about this quite a bit. As HTML applications continue to evolve we should make them feel "appish". Things like selectable buttons take the user away from experience the app. Also graph labels shouldn't be selectable. One of the big ideas of the web is selectable content. However UI elements shouldn't be included in this set. I've written a little more about this (with some screenshots to illustrate my th…

I travel a lot and have to use UIs in several languages, and being able to copy the text on button labels (or graphs!) to paste it into a dictionary is very important to me. On some sites I have to fall back to using the web inspector and it's just as annoying every time.

Re: If malware authors ever learn how to spell we're all screwed

#54

Post by csmeder »

kht786 wrote: post #51
csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Enough users will end up using certain images such as the tiger making it worthwhile to fake a prompt.

   "The user is then presented 10 images (a tiger, 
   a house, a moose, etc) from a library of 10,000 images."
I should have made this more clear. The ten images are chosen randomly from the group of 10,000

The question is: are there 10,000 images that are different enough people won't be fooled. Say my picture is a green house. And a prompt has a picture of a red house, will I accidentally think its the right site key?

The good news is most people won't even have a picture of a house as their site key so it will protect a large percent.

Re: If malware authors ever learn how to spell we're all screwed

#55

Post by arriu »

gergles wrote: post #29
arriu wrote: post #16

One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

If you are making a WebGL game, you do not want UI elements to select each time you try to rotate the camera.

I have used this property quite a few times for perfectly legitimate reasons. Any time that the user needs to click and drag to accomplish an action other than selecting text, you would want to use this.

Re: If malware authors ever learn how to spell we're all screwed

#56

Post by deno »

gergles wrote: post #29
arriu wrote: post #16

One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

You could do this for a long time by calling Event::preventDefault method on MOUSEDOWN event. This is just the same using CSS.

Obviously, this is useful for a lot of things, disabling selection being only one.

Re: If malware authors ever learn how to spell we're all screwed

#57

Post by slavak »

csmeder wrote: post #50
alister wrote: post #42

The OP's point is that displayed content can be made to be indistinguishable from visual elements of the browser even for technically sophisticated users in the near future. This reminds me of login spoofing of yesteryear. How do you know if the login prompt on a shared computer or terminal is really from the OS or is a user-level program trying to steal passwords? The usual solution was to hit a special attention ke…

Easy solution. Logging in takes two passwords. After you enter your first password (first 8 chars of your 16 char password) you are presented with an image of a Tiger. You now trust the system. (The picture of a tiger was your secret image). You now enter your second password (the remaining 8 chars of your 16 digit password). See site key: http://en.wikipedia.org/wiki/SiteKey

Great, you've now effectively reduced your password complexity to a measly 8 characters, while forcing the user to remember a 16-character long password.

Re: If malware authors ever learn how to spell we're all screwed

#58

Post by rhengles »

tlrobinson wrote: post #22

I forget what the term for it is, but there's a principle that any dialog that's asking the user for credentials or authorization must be clearly delineated from the rest of the UI and thus "unspoofable". The example I recall was a "ribbon" in the OS that slide out to reveal the dialog. If a dialog presented itself but the ribbon remained along the edge you could immediately tell it was spoofed. Of course this requir…

This is the reason why I hated the move of the notification bar in Internet Explorer 9 from the top to the bottom of the window. And the UI is too simple to be spoofed.

Re: If malware authors ever learn how to spell we're all screwed

#59

Post by johnhess »

csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

My bank used to do this, and I never quite understood why. An attacker could easily mimic the site's behavior.

1. Attacker prompts me (or my grandmother) for login name. 2. Attacker gives login name to bank. 3. Bank serves proper image to attacker. Attacker stores image. 4. Profit.

Re: If malware authors ever learn how to spell we're all screwed

#60

Post by FreeFull »

recoiledsnake wrote: post #32
tlrobinson wrote: post #22

I forget what the term for it is, but there's a principle that any dialog that's asking the user for credentials or authorization must be clearly delineated from the rest of the UI and thus "unspoofable". The example I recall was a "ribbon" in the OS that slide out to reveal the dialog. If a dialog presented itself but the ribbon remained along the edge you could immediately tell it was spoofed. Of course this requir…

You mean like the Vista and Win 7 UAC screen? http://www.micro-isv.asia/img/win7uac.png

What would prevent someone from spoofing this? (other than there being no apparent reason to spoof it)
Post reply on HN