Using the HTML5 Fullscreen API for Phishing Attacks

Brilliant, terrifying, wonderfully crafted and well-communicated work. Where do we go from here?

The demo you've put together is very nice. It even accounts for the different UI styling of individual browsers. However in all cases that the link worked, I received a very large warning that has to be manually dismissed.

This is not a rhetorical question; do you think people would ignore the warning and continue to use the site?

An easier phishing technique would be to manipulate the address to appear legitimate using pushState.

I don't know about your browser, but mine (Chrome 22) showed a very obvious warning that my browser was now in fullscreen mode.

I certainly wouldn't be tricked by this, but someone less technically savvy could be.

Firefox has a big warning that asks permission and dims the background, making it difficult to use until you select allow or deny, so it won't work as well with Firefox.

Chrome 23 just makes it full screen with a small notice.

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists.

Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or to generally annoy users. I'm wondering how soon it will be before someone makes the HTML5-equivalent of ClickToFlash.