Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

71–80 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#71

Post by graue »

halfasleep wrote: post #63
graue wrote: post #52

Earlier quoted context omitted.

The Firefox "untrusted connection" screen ( https://support.mozilla.org/en-US/kb/connection-untrusted-er... ) is much better designed. "Get me out of here!" is the only visible button and the obvious action. To override the SSL check, you have to click "I Understand the Risks" to expand the page, revealing both an "Add Exception..." button and a further warning (in bold). "Add Exception..." brings up a dialog which a…

I also prefer Firefox's handling of SSL issues. Allowing permanent whitelisting of sites reduces the number of times a user will see the warning, reducing the muscle memory around clicking proceed anyway.

That's a great point. I didn't even think of the muscle memory issue, but by having the exception be permanent by default, they got that right too.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#72

Post by feross »

jkeesh wrote: post #27

Wow Feross. Another sweet demo. I still feel like there is so much to learn about security, but what I am always amazed at is that the "social engineering" attacks seem to be the problems that we can never solve. Yes, there is a technical component (HTML5 full screen api), but at its core this is a phishing attack, a "fool the user" attack, and not an actual technical security flaw. Basically, if I wasn't paying atte…

Thanks Jeremy!

"What can be done to save the casual, but maybe unfortunately inept internet user?"

That's a really good question and unfortunately I don't think anyone has a good answer.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#73

Post by feross »

esolyt wrote: post #30
Zancarius wrote: post #16

Earlier quoted context omitted.

Same here. I have an addiction to opening everything remotely interesting in a new tab, and my initial reaction was "I don't think this worked?" Otherwise, it's pretty frightening, because I can imagine that in spite of the browser warnings, there are many non-savvy users who probably wouldn't give it a second thought. As a KDE user, the blatant Gnome UI was kind of glaring but otherwise well done. ;)

Not even Gnome. It is Ubuntu interface. I guess they were assuming most Linux users are Ubuntu users.

Yep, that's what I assumed. :) Also, for a proof-of-concept you're lucky I even took screenshots in any Linux ;)

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#74

Post by feross »

vog wrote: post #69

Unfortunately, the site is down: Iceweasel can't establish a connection to the server at www.feross.org.

Site is still up.

Are you, by chance, using HTTPS Everywhere? I think they have an erroneous rule about my site which redirects you to https:// which I no longer provide.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#75

Post by feross »

halfasleep wrote: post #63
graue wrote: post #52

Earlier quoted context omitted.

The Firefox "untrusted connection" screen ( https://support.mozilla.org/en-US/kb/connection-untrusted-er... ) is much better designed. "Get me out of here!" is the only visible button and the obvious action. To override the SSL check, you have to click "I Understand the Risks" to expand the page, revealing both an "Add Exception..." button and a further warning (in bold). "Add Exception..." brings up a dialog which a…

I also prefer Firefox's handling of SSL issues. Allowing permanent whitelisting of sites reduces the number of times a user will see the warning, reducing the muscle memory around clicking proceed anyway.

The point about "muscle memory" is great and definitely not discussed enough.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#76

Post by tymekpavel »

wtallis wrote: post #51
AngryParsley wrote: post #10

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists. Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or…

NoScript already inherently blocks this, and even if you allow the domain that provides the script that tries to go full-screen, and allow the full-screen transition, the web page pretending to be a desktop doesn't cover the NoScript toolbar that's still prompting for permissions on the other domains. I suspect the anti-clickjacking measures would kick in if the phishing site tried to incorporate the real site as a b…

I don't think the average user knows what NoScript is.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#77

Post by masklinn »

peterhunt wrote: post #57
feross wrote: post #42

Earlier quoted context omitted.

Safari has no warning or message at all. Just a quick, half-second animation and that's it.

Safari disallows keyboard input in fullscreen mode.

Entirely? So no way to use fullscreen mode for keyboard-driven games in saf'?

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#80

Post by guelo »

damncabbage wrote: post #12

The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

This is pissing me off. The link hover should be sacred, browsers shouldn't allow any trickery there.
Post reply on HN