Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vancouver PD website features Quick Escape button that wipes itself from history

vpd.ca

Post reply on HN
Print view View original

51–60 of 156 posts

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#51

Post by jerbearito »

hyperhello wrote: post #33
jerbearito wrote: post #32

Earlier quoted context omitted.

"That seems like a major security issue." Do you mean something you verified is happening or something you assumed is happening? You can go look at the site OP linked and find out what is happening and if it's a "major security issue". In this case, after user click/intervention, it renames the current history entry to "New Tab". This is not a security issue at all.

Well, it’s right there in the headline that the website wipes itself from history, so I don’t need any realignment of my ability to discern what I’ve read from what I’ve imagined. If all the site is doing is renaming itself New Tab then that sure isn’t newsworthy. Maybe a domestic violence reporting site should just name itself something innocuous in general without the quick escape? But nonetheless, a web site repla…

"so I don’t need any realignment of my ability to discern what I’ve read from what I’ve imagined"

Not what I asked but I'm glad you're doing okay! I share your concerns.

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#52

Post by ksaj »

jagged-chisel wrote: post #22
herpderperator wrote: post #18

Earlier quoted context omitted.

https://govt.nz isn't a thing, but https://www.govt.nz is.

The former should forward to the latter.

Agreed. If the content isn't really designed for the wide world, the www hostname seems to be self-defeating, or at least describing the wrong thing.

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#53

Post by jerbearito »

hyperhello wrote: post #45
xdkaplan wrote: post #41

Earlier quoted context omitted.

Not to start an argument but in lamence terms, renaming history to "New Tab" is as close to wiping history as a website can manage. Concealing, obfuscating, hiding might have been better words but the non technucal audience would not see an issue with the language. Nuance is important, though and i agree its slightly misleading

I just tested it on both iPhone and Android and it does indeed remove itself from history and replaces with a link to a weather domain. That’s incredible that it is allowed and I can trivially think of a way to get someone to get to a fake banking site right now, or for that matter, fill the history with a series of visits to domestic violence sites or even worse!

https://developer.mozilla.org/en-US/docs/Web/API/Location/re...

This is known and commonly used -- since 1996. What's the risk? You can't change records about other domains.

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#54

Post by 100721 »

xdkaplan wrote: post #41
hyperhello wrote: post #33

Earlier quoted context omitted.

Well, it’s right there in the headline that the website wipes itself from history, so I don’t need any realignment of my ability to discern what I’ve read from what I’ve imagined. If all the site is doing is renaming itself New Tab then that sure isn’t newsworthy. Maybe a domestic violence reporting site should just name itself something innocuous in general without the quick escape? But nonetheless, a web site repla…

Not to start an argument but in lamence terms, renaming history to "New Tab" is as close to wiping history as a website can manage. Concealing, obfuscating, hiding might have been better words but the non technucal audience would not see an issue with the language. Nuance is important, though and i agree its slightly misleading

What does “lamence” mean?

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#55

Post by Cub3 »

ksaj wrote: post #52
jagged-chisel wrote: post #22

Earlier quoted context omitted.

The former should forward to the latter.

Agreed. If the content isn't really designed for the wide world, the www hostname seems to be self-defeating, or at least describing the wrong thing.

This is amazingly pedantic, I love it.

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#56

Post by [deleted] »

100721 wrote: post #54
xdkaplan wrote: post #41

Earlier quoted context omitted.

Not to start an argument but in lamence terms, renaming history to "New Tab" is as close to wiping history as a website can manage. Concealing, obfuscating, hiding might have been better words but the non technucal audience would not see an issue with the language. Nuance is important, though and i agree its slightly misleading

What does “lamence” mean?

[deleted]

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#58

Post by hyperhello »

jerbearito wrote: post #53
hyperhello wrote: post #45

Earlier quoted context omitted.

I just tested it on both iPhone and Android and it does indeed remove itself from history and replaces with a link to a weather domain. That’s incredible that it is allowed and I can trivially think of a way to get someone to get to a fake banking site right now, or for that matter, fill the history with a series of visits to domestic violence sites or even worse!

https://developer.mozilla.org/en-US/docs/Web/API/Location/re... This is known and commonly used -- since 1996. What's the risk? You can't change records about other domains.

I knew about history.replace but I had no idea you could cross sites. Suppose a site, for example, leaves a trail of Amazon Shopping, and curious, you go to it to recall what you did, but it’s Amaz0n instead.

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#59

Post by post-it »

hyperhello wrote: post #58
jerbearito wrote: post #53

Earlier quoted context omitted.

https://developer.mozilla.org/en-US/docs/Web/API/Location/re... This is known and commonly used -- since 1996. What's the risk? You can't change records about other domains.

I knew about history.replace but I had no idea you could cross sites. Suppose a site, for example, leaves a trail of Amazon Shopping, and curious, you go to it to recall what you did, but it’s Amaz0n instead.

Well there's no need to suppose. While I think if it hasn't been exploited in 30 years, there probably isn't an attack surface, you can always demonstrate and report an exploit.

Re: Vancouver PD website features Quick Escape button that wipes itself from history

#60

Post by tanbog100 »

I've implemented quick exit/escape buttons for a few organisations over the years and have spent a bit of time thinking about the limitations.

This pattern is definitely better than most and it is refreshing seeing they put some resources into it. In my professional experience, organisations often chose the "a link to another site like google is fine" option to save money and time while still getting to boast about their security culture.

One thing I have not found much research on however, but would love to hear about, is the effect of these kinds of patterns on the user's speed and choice of actions and how that effects outcomes. What I mean by that is, say someone is visiting the site on their phone and an adversary walks into the room. Most people these days know the fastest way to leave a page at short notice - maybe the home button/gesture, maybe swipe to another open app. Does having a big red button that introduces a new choice help them, or add to the cognitive bandwidth needed to handle the situation?

Remember, by definition the type of situations that this component is intended to help with are going to be stressful and likely have little to no warning; the person is going to walk in the room and the user has moments to act.

What is going to lead to measurably better outcomes; a big red button that the user needs to read, understand and move their finger/hand to, or their own knowledge of their own device's most efficient escape mechanisms?

This isn't meant as a criticism of the component. I am just genuinely curious as to what the best tool to assist folks in this situation is? We are talking about real people with real fears and the possibility of very bad outcomes.

Post reply on HN