21–30 of 133 posts
The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)
The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done.
for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission boxes similar to when the browser requests your location.
It is good for developers to understand this, though, but I wouldn't say that the spec is broken, or that this is a bad feature, it can be implemented securely and with warnings. Anti-phishing education for users should involve primarily talking about not trusting links anywhere and typing in the address directly.
Edit: Here it is from the Spec:
http://dvcs.w3.org/hg/fullscreen/raw-file/tip/Overview.html#...
> 7. Security and Privacy Considerations
> User agents should ensure, e.g. by means of an overlay, that the end user is aware something is displayed fullscreen. User agents should provide a means of exiting fullscreen that always works and advertise this to the user. This is to prevent a site from spoofing the end user by recreating the user agent or even operating system environment when fullscreen. See also the definition of requestFullscreen().
> To prevent embedded content from going fullscreen only embedded content specifically allowed via the allowfullscreen attribute of the HTML iframe element will be able to go fullscreen. This prevents untrusted content from going fullscreen.
I am most familiar with Safari and Chrome (have been meaning to get up-to-date with Firefox, which has had a lot of good work put into it) but all of the major browser vendors have done something around this in their own way with both desktop and mobile releases.
It is at the discretion of each vendor how they implement security warnings or settings around full screen mode. They all have slightly different implementations but the end result is that they go some way towards preventing a phishing attack using Fullscreen.
That said, it was a good idea to bring this issue to the attention of developers and users as a potential attack vector and as a demonstration of why the security dialogs are important.
Edit II: The whatwg thread where the security considerations are discussed begins here:
http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2009-Dec...
The first post rightly points out that Flash had the feature implemented in a non-secure manner for a long time.
Great job! But originally, I opened that link in a new tab while I was still reading the article. It obviously did not work :P I've this habit of opening most links in a new tab!
Same here. I have an addiction to opening everything remotely interesting in a new tab, and my initial reaction was "I don't think this worked?" Otherwise, it's pretty frightening, because I can imagine that in spite of the browser warnings, there are many non-savvy users who probably wouldn't give it a second thought. As a KDE user, the blatant Gnome UI was kind of glaring but otherwise well done. ;)
Both Chrome and Firefox show warnings when a page uses the fullsrceen API. Is there a browser out there that doesn't?
The demo you've put together is very nice. It even accounts for the different UI styling of individual browsers. However in all cases that the link worked, I received a very large warning that has to be manually dismissed. This is not a rhetorical question; do you think people would ignore the warning and continue to use the site? An easier phishing technique would be to manipulate the address to appear legitimate us…
"do you think people would ignore the warning and continue to use the site?" I actually made this demo back in April but just got around to posting about it now. In the meantime, Firefox and Chrome have made their warning messages more prominent. Still, I think it's a pretty major issue. Experienced web users won't be fooled by something like this. But, even if 1% of users are fooled by this technique, that's still p…
Basically, if I wasn't paying attention, I feel like this was good enough to fool me. What can be done to save the casual, but maybe unfortunately inept internet user?
Google Chrome asks for authorization to enter fullscreen mode. I've updated my browser this morning to Version 22.0.1229.92 m, is it new?
When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell). The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done. for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission bo…
Firefox does it too, and in a much more obvious way than either Chrome or Safari. Here are all the latest browsers on Mac compared: http://imgur.com/a/jdcI7 (Sorry Opera; I haven't re-installed you yet.)
I actually didn't get any permissions dialog or warning label in Safari 6; maybe I ok'd it for another site at some point in the past, but I definitely didn't whitelist this domain.
Great job! But originally, I opened that link in a new tab while I was still reading the article. It obviously did not work :P I've this habit of opening most links in a new tab!
Same here. I have an addiction to opening everything remotely interesting in a new tab, and my initial reaction was "I don't think this worked?" Otherwise, it's pretty frightening, because I can imagine that in spite of the browser warnings, there are many non-savvy users who probably wouldn't give it a second thought. As a KDE user, the blatant Gnome UI was kind of glaring but otherwise well done. ;)