Using the HTML5 Fullscreen API for Phishing Attacks • Hacker News Board

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#131

Post by est » Wed, Oct 10, 2012, 12:18 AM UTC

hatu wrote: post #108

est wrote: post #24

only works if you browse in maximum window browsers.

On Chrome 22 (Win 7) it went fullscreen even from a window.

I mean if your browser window if NOT maximum then suddenly your browser is maximum. You get suspicious.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#132

Post by masklinn » Wed, Oct 10, 2012, 8:11 AM UTC

peterhunt wrote: post #124

masklinn wrote: post #77

Earlier quoted context omitted.

Entirely? So no way to use fullscreen mode for keyboard-driven games in saf'?

That's correct, this is why the Facebook full-screen photo viewer is not enabled in Safari even though the API is supported.

That stinks.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#133

Post by ivanb » Wed, Oct 10, 2012, 9:24 AM UTC

cfinke wrote: post #29

nikcub wrote: post #22

When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell). The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done. for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission bo…

which Chrome and Safari have done Firefox does it too, and in a much more obvious way than either Chrome or Safari. Here are all the latest browsers on Mac compared: http://imgur.com/a/jdcI7 (Sorry Opera; I haven't re-installed you yet.) I actually didn't get any permissions dialog or warning label in Safari 6; maybe I ok'd it for another site at some point in the past, but I definitely didn't whitelist this domain.

These messages do not show any warnings about possible malicious activity. This is enough to get a few not so computer-savvy people to get robbed.