Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

121–130 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#121

Post by romaniv »

nikcub wrote: post #22

When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell). The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done. for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission bo…

Why do we need a JavaScript based API for this anyway? Wouldn't it be MUCH better to allow websites detect when user presses F11 instead? It's not just about security, it's about managing expectations and familiar UI.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#122

Post by finnw »

oliciv wrote: post #116
finnw wrote: post #89

Earlier quoted context omitted.

I won't be surprised if both Google and MS restrict this in their browsers in the near future, but make exceptions for their own search engines.

I won't be holding my breath for major browsers to remove support for JS click events!

Probably not, but if a regular link has an onClick event, they might show a big red warning message in the status bar in place of the URL.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#123

Post by bpatrianakos »

Its really annoying and alarming to hear technical people rebut this with "Well I could tell the difference because I noticed my browser changed and my super customized desktop settings weren't reproduced, and plus it says "now in full screen mode", etc.". Its alarming because this type of response just goes to show that the people creating things for the web are so completely out of touch with real users. There's this weird idea among developers that users know how to use technology just like we do when in fact they don't even know which website handles their email half the time, think Google is the internet, use the browser search bar to type full URLs even though the actual address bar is 10 pixels to the left, and will blame you for giving them a virus because you changed their desktop wallpaper and not because of all those shady links to foreign lotteries they were clicking in their email which they were lucky to find in the first place.

Yeah, you can tell the difference. I could tell the difference. Yes it was very obvious even though the demo was very accurate in reproducing my browser's chrome. But the rest of the world is nothing like us. Feross says 10% will be tricked. I think that's a very conservative estimate. I wouldn't be surprised is the numbers went above 50%. If this sort of attack becomes common then I bet you anything that the majority of users will be tricked just because full screen is not very common. You'll say full screen is common but again, you're thinking of people just like you who are in the minority. Most people have never seen a website in full screen mode. Even with Facebook's full screen option it doesn't mean your parents are clicking that option or have even noticed it yet.

I'm actually building an app currently that greatly benefits from the full screen API and I really hope vendors don't start putting more restrictions on it. Instead I'm hoping there's a way to make full screen more common in legitimate ways, get users used to full screen mode so they are aware of it and know what the little "Now in full screen mode" dialog means. Sure, people will still get tricked but I'd bet it would be in far less numbers and that 10% figure Feross throws out there might become more realistic.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#124

Post by peterhunt »

masklinn wrote: post #77
peterhunt wrote: post #57

Earlier quoted context omitted.

Safari disallows keyboard input in fullscreen mode.

Entirely? So no way to use fullscreen mode for keyboard-driven games in saf'?

That's correct, this is why the Facebook full-screen photo viewer is not enabled in Safari even though the API is supported.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#125

Post by [deleted] »

shardling wrote: post #115
ygra wrote: post #99

Earlier quoted context omitted.

There was an interesting research a few years ago regarding the SSL icon. Since in many users the idea is actually finely-ingrained that a padlock means security on a website they just made the favicon into a lock. A surprisingly large number of users was fooled by that. I guess the "padlock means secure" has been superceded a little by "address bar is green somewhere" by now, but the problem remains the same.

That's why Firefox no longer has the favicon in the URL bar.

[deleted]

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#126

Post by anonymfus »

robmcm wrote: post #95
skeletonjelly wrote: post #48

Earlier quoted context omitted.

Funnily enough Safari is the only browser that doesn't alert the user about fullscreen mode. http://imgur.com/a/jdcI7 (via cfinke)

and even Adobe managed to add warnings to the flash player... Silly Apple

Adobe has warnings long before first drafts of HTML5 fullscreen API.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#127

Post by anonymfus »

So many people there write about warnings...

Imagine you opened new fresh HTML5-based game. It requested fullscreen, you allowed. You finished game and clicked on "Exit fullscreen" button. Then, instead of canceling fullscreen mode, you got just perfect illusion of it. Site author created almost complete replacement of your browser or ever your OS UI. So when you created new tab and entered news.ycombinator.com address it was loaded via proxy.

May be it's already happened in this demo. Wake up, Neo, and press Esc to exit from Matrix, ...sorry, from Fullscreen Mode.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#128

Post by pbhjpbhj »

EGreg wrote: post #104
pbhjpbhj wrote: post #100

Earlier quoted context omitted.

Yahoo do something like this, they display a per user image on the login, presumably using cookies?

The only thing is, if you don't wait until the user starts entering the password, the attacker can theoretically scrape the page with your username and find out the per-user image.

You don't get the image based on the username, the image is stored as a cookie, so it's showing you that the Yahoo you logged in to this time is the one that new your cookie details before. Even if an attack-site can read your cookie they don't know which image to pair it with (though maybe it can be taken from a local cache somehow?). The image is a per-device (or per browser?) security indication.

Details - https://protect.login.yahoo.com/login/set_pref?faq=1#faq2, it's called "yahoo sign-in seal".

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#130

Post by EGreg »

pbhjpbhj wrote: post #128
EGreg wrote: post #104

Earlier quoted context omitted.

The only thing is, if you don't wait until the user starts entering the password, the attacker can theoretically scrape the page with your username and find out the per-user image.

You don't get the image based on the username, the image is stored as a cookie, so it's showing you that the Yahoo you logged in to this time is the one that new your cookie details before. Even if an attack-site can read your cookie they don't know which image to pair it with (though maybe it can be taken from a local cache somehow?). The image is a per-device (or per browser?) security indication. Details - https:/…

Oh! Well that's a smart idea... that's kind of like showing you your private "profile picture" when you are logged in.

But if you have a session cookie, then you hardly need a password. Unless we are talking about a public computer where you need to enter your password.

I am talking about the times when you DON'T have a session cookie, and you are prompted to sign in with a password. That's the thing that could be spoofed.

Post reply on HN