11–20 of 133 posts
However, most users (even experienced users) don't look at the url when visiting information-sensitive websites and www.bankofamerica.fsh4.com would still not alarm them. They don't understand the SSL icon either.
The user can hover their mouse over the link and their
status bar will show https://www.bankofamerica.com, as
expected.
(It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)
Brilliant, terrifying, wonderfully crafted and well-communicated work. Where do we go from here?
Firefox has a big warning that asks permission and dims the background, making it difficult to use until you select allow or deny, so it won't work as well with Firefox. Chrome 23 just makes it full screen with a small notice.
The least savvy are UI-blind, a big portion won't realize a transition just occurred, and a great majority of them will not read the warning beyond the first line.
Earlier quoted context omitted.
Firefox has a big warning that asks permission and dims the background, making it difficult to use until you select allow or deny, so it won't work as well with Firefox. Chrome 23 just makes it full screen with a small notice.
This is true, I saw it too. But a popup telling the user to 'Allow Fullscreen?' is semantically equivalent to "Click Yes If You Want To Log On To Your Bank" for most users. The least savvy are UI-blind, a big portion won't realize a transition just occurred, and a great majority of them will not read the warning beyond the first line.
Great job! But originally, I opened that link in a new tab while I was still reading the article. It obviously did not work :P I've this habit of opening most links in a new tab!
Otherwise, it's pretty frightening, because I can imagine that in spite of the browser warnings, there are many non-savvy users who probably wouldn't give it a second thought.
As a KDE user, the blatant Gnome UI was kind of glaring but otherwise well done. ;)
The demo you've put together is very nice. It even accounts for the different UI styling of individual browsers. However in all cases that the link worked, I received a very large warning that has to be manually dismissed. This is not a rhetorical question; do you think people would ignore the warning and continue to use the site? An easier phishing technique would be to manipulate the address to appear legitimate us…
I actually made this demo back in April but just got around to posting about it now. In the meantime, Firefox and Chrome have made their warning messages more prominent. Still, I think it's a pretty major issue.
Experienced web users won't be fooled by something like this. But, even if 1% of users are fooled by this technique, that's still potentially thousands of innocent web users, which I think is unacceptable.
Earlier quoted context omitted.
This is true, I saw it too. But a popup telling the user to 'Allow Fullscreen?' is semantically equivalent to "Click Yes If You Want To Log On To Your Bank" for most users. The least savvy are UI-blind, a big portion won't realize a transition just occurred, and a great majority of them will not read the warning beyond the first line.
If that is the case, how is it a significantly worse problem than a regular link to a fake site?
I imagine all of the payload (save for the return trip) could be put into innocent looking client-side Javascript, but that doesn't get around the fact that someone's still got to serve the JS...
Earlier quoted context omitted.
This is true, I saw it too. But a popup telling the user to 'Allow Fullscreen?' is semantically equivalent to "Click Yes If You Want To Log On To Your Bank" for most users. The least savvy are UI-blind, a big portion won't realize a transition just occurred, and a great majority of them will not read the warning beyond the first line.
If that is the case, how is it a significantly worse problem than a regular link to a fake site?