111–120 of 133 posts
Actually, it isn't, at least for some users. More than one member of my family has fallen for the "your computer has a virus" scams, which use Windows chrome, on Ubuntu machines.
Earlier quoted context omitted.
The latest version of Safari shows no warning on fullscreen, making users very vulnerable. The only indication is a short, half-second animation (it's much shorter than the usual OS X fullscreen animation). After that, there's no indication that you're in fullscreen mode.
Safari also completely disallows keyboard input in fullscreen mode, which majorly mitigates the vulnerability.
The concept is clever, and very interesting. However, most users (even experienced users) don't look at the url when visiting information-sensitive websites and www.bankofamerica.fsh4.com would still not alarm them. They don't understand the SSL icon either.
There was an interesting research a few years ago regarding the SSL icon. Since in many users the idea is actually finely-ingrained that a padlock means security on a website they just made the favicon into a lock. A surprisingly large number of users was fooled by that. I guess the "padlock means secure" has been superceded a little by "address bar is green somewhere" by now, but the problem remains the same.
Earlier quoted context omitted.
This is pissing me off. The link hover should be sacred, browsers shouldn't allow any trickery there.
I won't be surprised if both Google and MS restrict this in their browsers in the near future, but make exceptions for their own search engines.
The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)
This is pissing me off. The link hover should be sacred, browsers shouldn't allow any trickery there.
The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)
This was really annoying for me because somehow the google redirect link took a lot longer to load than the ultimate destination would, or even regular google pages.
That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists. Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or…
NoScript already inherently blocks this, and even if you allow the domain that provides the script that tries to go full-screen, and allow the full-screen transition, the web page pretending to be a desktop doesn't cover the NoScript toolbar that's still prompting for permissions on the other domains. I suspect the anti-clickjacking measures would kick in if the phishing site tried to incorporate the real site as a b…
When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell). The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done. for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission bo…
Flash disabled all "printing" keys in full-screen mode, and disabled a warning label when entered into the mode. FS could only be entered from user action. So Flash's full-screen mode was limited but fairly secure.