Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

61–70 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#61

Post by geon »

blaines wrote: post #33

I think the "Door Study" [1] was the best part! It's hilarious, and horrible that the guy didn't notice the swap. Maybe I've just lived in a big city long enough that I'm not surprised by the World Famous Bushman [2] or people's swindling. [1] http://www.youtube.com/watch?v=FWSxSQsspiQ&feature=playe... [2] http://en.wikipedia.org/wiki/World_Famous_Bushman

I was thinking the door-guy-swap footage where the victim noticed the swap must be perfect material for "Just for Laughs" [1]. Inversely, the "failed" Just for Laughs-material where the victims don't react must be perfect research material.

[1] http://www.youtube.com/watch?v=662KGcqjT5Q

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#62

Post by sesqu »

blaines wrote: post #33

I think the "Door Study" [1] was the best part! It's hilarious, and horrible that the guy didn't notice the swap. Maybe I've just lived in a big city long enough that I'm not surprised by the World Famous Bushman [2] or people's swindling. [1] http://www.youtube.com/watch?v=FWSxSQsspiQ&feature=playe... [2] http://en.wikipedia.org/wiki/World_Famous_Bushman

Derren Brown did a couple of bits on the door study that you might enjoy: https://www.youtube.com/watch?v=vBPG_OBgTWg

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#63

Post by halfasleep »

graue wrote: post #52
shock3naw wrote: post #40

Earlier quoted context omitted.

To corroborate your point, one of the Chromium developers spoke about this sort of problem, but in the context of invalid SSL certificates and the associated warning that Chrome displays. A ridiculous percentage of users ignored the warning that the site they were visiting wasn't verified and simply clicked 'Visit this site anyway.' Most users don't understand that there are potentially serious costs to ignoring secu…

The Firefox "untrusted connection" screen ( https://support.mozilla.org/en-US/kb/connection-untrusted-er... ) is much better designed. "Get me out of here!" is the only visible button and the obvious action. To override the SSL check, you have to click "I Understand the Risks" to expand the page, revealing both an "Add Exception..." button and a further warning (in bold). "Add Exception..." brings up a dialog which a…

I also prefer Firefox's handling of SSL issues. Allowing permanent whitelisting of sites reduces the number of times a user will see the warning, reducing the muscle memory around clicking proceed anyway.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#64

Post by FooBarWidget »

skeletonjelly wrote: post #46
AngryParsley wrote: post #10

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists. Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or…

By presentation mode you mean fullscreen (F11)? I had a quick search and couldn't find anything conclusive. It's an OSX specific thing?

In OS X, "Full screen" triggers the Lion native full screen mechanism. In this mode Chrome is full-screen but you still see the toolbar. "Presentation mode" is more like what "Full screen" did before Lion, or how full screen behaves on other OSes: no toolbar.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#66

Post by feross »

jmitcheson wrote: post #45

You're being a bit disingenuous by not mentioning the inbuilt protections that the HTML5 Fullscreen API offers. "Also, any alphanumeric keyboard input while in full-screen mode causes a warning message to appear; this is done to help guard against phishing attacks. The following keys are the only ones that don't cause this warning message to appear (...)" ( https://developer.mozilla.org/en-US/docs/DOM/Using_full-scre…

That documentation is out-of-date. There were no warnings on keyboard input in Firefox or Chrome. I went fullscreen on a Facebook photo and was able to leave a comment without any issues.

Safari, on the other hand, appears to prevent keyboard input, which I just recently found out.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#67

Post by graue »

shock3naw wrote: post #58
graue wrote: post #52

Earlier quoted context omitted.

The Firefox "untrusted connection" screen ( https://support.mozilla.org/en-US/kb/connection-untrusted-er... ) is much better designed. "Get me out of here!" is the only visible button and the obvious action. To override the SSL check, you have to click "I Understand the Risks" to expand the page, revealing both an "Add Exception..." button and a further warning (in bold). "Add Exception..." brings up a dialog which a…

I agree that Firefox's certificate warning page is much better designed. I'm not blaming 'dumb' users for anything, I was providing supporting evidence of the fact that when browsers make warnings easy to bypass, users will simply click right through them.

Absolutely. If I took issue with anything in your post specifically it was "Most users don't understand that there are potentially serious costs". This to me seems to implicitly blame the users for not understanding, whereas I'd blame Chrome for a UI that makes it easy for a distracted user not to understand. As developers we have a responsibility not to lead users into doing something dangerous just because we don't have their full, undivided attention.

I was mostly disagreeing with the general "blame the users" mentality apparent upthread and among developers in general, not with you specifically. I've edited my post to make that clearer.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#68

Post by [deleted] »

shock3naw wrote: post #58
graue wrote: post #52

Earlier quoted context omitted.

The Firefox "untrusted connection" screen ( https://support.mozilla.org/en-US/kb/connection-untrusted-er... ) is much better designed. "Get me out of here!" is the only visible button and the obvious action. To override the SSL check, you have to click "I Understand the Risks" to expand the page, revealing both an "Add Exception..." button and a further warning (in bold). "Add Exception..." brings up a dialog which a…

I agree that Firefox's certificate warning page is much better designed. I'm not blaming 'dumb' users for anything, I was providing supporting evidence of the fact that when browsers make warnings easy to bypass, users will simply click right through them.

[deleted]
Post reply on HN