Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Line of Death

textslashplain.com

Post reply on HN
Print view View original

21–30 of 108 posts

Re: The Line of Death

#21

Post by lucideer »

smacktoward wrote: post #9

This is an interesting case where security and design are in direct collision. From a security perspective you'd want the demarcation between the application itself and the untrusted content area to be as clear and obvious as possible, which would mean drawing big borders between them so thick nobody could possibly miss them. But contemporary design is all about being "clean," part of which involves making borders ra…

I don't think I really agree with this. Making good visual design, or let's say in this case "clean" visual design, work is up to the designer.

Taking for example the Opera 12 example I mentioned in comments above[0]: while I don't think Opera's overall UI design in 2011 was particularly visually pleasing, and certainly not as clean as Chrome's today, if you consider the UI pattern in isolation there's nothing preventing it from being done cleanly. Facebook uses the same UI pattern for the active state of its status input today.

That's just one obvious example - I'm not suggesting it's the only one. Google's Material Design guidelines advocate a lot of context-crossing - the canonical example being the "Floating action button" attaching to sheets[1]

[0] https://news.ycombinator.com/item?id=13400645

[1] https://material.io/guidelines/components/buttons-floating-a...

Re: The Line of Death

#22

Post by qume »

How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area.

Also with a buffer so nothing too similar is allowed, or perhaps a warning comes up if something is close.

I vote for something like the chrome dinosaur.

Re: The Line of Death

#23

Post by userbinator »

yosefk wrote: post #15

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously different. With the setup I have, it's almost hilarious to see all the adverts with fake dialogs and buttons that look nothing like the real ones on my system; the font, the colours, the controls, everything stands out as being different.

Re: The Line of Death

#24

Post by rocqua »

The comment made about domain names not being trustworthy is why I like EV-certificates.

Some people (notably google) argue that EV-certificates add very little of value because the user can just as easily check the domain name. Thing is, I could probably get some paypal or google like domain. Even if I can't, I could use a data URI as in [1] to put https://google.com in the address bar.

Compare that to EV. To get a browser to display google (or googel, or paypal), I'd need to convince a CA to issue such an EV cert. Whilst that might not be impossible, it takes something close to a state-level actor. A lot of phishers operate below that level.

What EV gives over the domain name is a fully CA controlled part of the UI. Whilst the address bar is the 'zone of death by phisher' the EV bar is the 'zone of death by CIA/KGB'.

[1] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-u...

Re: The Line of Death

#25

Post by lucideer »

niftich wrote: post #18
dom0 wrote: post #10

Earlier quoted context omitted.

http://schubiserv.de/images/opera-benutzerauthentifizierung....

I still disagree with both lucideer's original and improved wording, but I agree with their message, which praises Opera's basic auth UI as making it clear with the borders and 3D foreground overlay effect that it's a part of the browser-produced "trusted zone", and not the pool of untrusted content behind. Moreover, these kinds of UIs are still possible with the 'flat' look that's in vogue today, so there's little e…

On my wording, apologies (edited). I was thinking of "breaking" in terms of "breaking/crossing a line/barrier one does not typically cross". Probably not the best wording in retrospect.

On the comments on basic auth losing out, you might be right that that's a reason, but HTML5 APIs requiring some kind of UI confirmation from the user (like HTTP basic auth does) are far more proliferant than they once were (see http://permission.site/ for many examples), so I don't think that excuse is really good enough for browser vendors.

Incidentally, it's worth noting that the UI for this kind of thing (user confirmation prompts) is pretty much a solved problem on mobile: these prompts tend to use the OS notification API, so always appear outside the browser chrome entirely.

Re: The Line of Death

#26

Post by userbinator »

dsr_ wrote: post #16
ensignavenger wrote: post #6

It would be helpful if this post included mentions or links to any best practices to help mitigate this. Does anyone have any they would like to share?

Here's one: don't use the default window manager theme. This is much easier on Linux and *BSD than in Windows or MacOS. I've seen lots of picture-in-picture attacks. They usually simulate Windows title bars and controls. Hah. I once saw one on a Mac which adapted to the OS and tried to show a Mac window frame, but it was an outdated version. That brings me to another point: send an incorrect User-Agent. Same browser…

It used to be pretty easy to customise appearance on Windows, but the latest versions seem to have mostly castrated that functionality.

Re: The Line of Death

#27

Post by niftich »

lucideer wrote: post #25
niftich wrote: post #18

Earlier quoted context omitted.

I still disagree with both lucideer's original and improved wording, but I agree with their message, which praises Opera's basic auth UI as making it clear with the borders and 3D foreground overlay effect that it's a part of the browser-produced "trusted zone", and not the pool of untrusted content behind. Moreover, these kinds of UIs are still possible with the 'flat' look that's in vogue today, so there's little e…

On my wording, apologies (edited). I was thinking of "breaking" in terms of "breaking/crossing a line/barrier one does not typically cross". Probably not the best wording in retrospect. On the comments on basic auth losing out, you might be right that that's a reason, but HTML5 APIs requiring some kind of UI confirmation from the user (like HTTP basic auth does) are far more proliferant than they once were (see http:…

Desktop platforms like OS X, most Linux desktop environments, and newer versions of Windows have similarly allowed applications to hook into the OS' own notification mechanism for a while, but for some reason this model never caught on. One can argue that it's much clunkier on these platforms than on mobile, but the capability is now there.

Unfortunately, with HTML5 notifications, the ship has probably sailed on this and it went from being an intriguing idea to a bad one, as now it's getting mainstream for individual websites to generate OS-level notifications. This made a previously privileged pool of messages full of untrusted content.

Re: The Line of Death

#28

Post by enraged_camel »

userbinator wrote: post #23
yosefk wrote: post #15

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…

>>To fix this the answer is to educate the users

I used to believe this too. Over the past several years though, I've worked with many, many users from all walks of life, and I've come to realize the hard truth: the users simply don't give a shit. They already use a billion other apps in their day-to-day work and don't have time to spend watching training videos or reading documentation. So if they have to be educated to be able to use your app properly, you've lost.

This isn't to say that all users are like that. There are definitely ones who are tech-savvy and competent and curious. But the overwhelming majority want nothing other than to click a few buttons and get the results they want from the app. Anything more complex will cause them to give up and move on.

Re: The Line of Death

#29

Post by ams6110 »

userbinator wrote: post #23
yosefk wrote: post #15

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…

Back when it was still possible (Windows XP? Maybe Windows 7?) I would always turn off all the modern Windows chrome and animation and make it look like Windows 2000. Made for better responsiveness and as you say, you could spot fake dialog boxes in an instant.

Not a Windows user these days but I understand it's not possible to get the old Windows 2000 look anymore, though I'm sure you can still change color themes and appearance to some extent.

Re: The Line of Death

#30

Post by deathanatos »

qume wrote: post #22

How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area. Also with a buffer so nothing too similar is allowed, or perhaps a warning comes up if something is close. I vote for something like the chrome dinosaur.

Isn't this essentially the lock icon, today?

What is "trusted"? We get the lock icon if a valid TLS connection is formed; if you want a more secure connection, you can get EV certificates. We could do away with the lock icon and only show a broken lock if not on TLS, and only show something that looks secure on EV certs, (which seems to be where browsers are headed.)

A simple valid TLS connection getting the lock icon is problematic when people are using DNS names that are close-but-not-quite to things like paypal.com. And we want TLS certs to be issued automagically ala Let's Encrypt and such, so it's easy, unfortunately, to get a cert for paypal-not-quite.com. Such is the difference in "secure connection" and "a secure connection to a party you trust."

Post reply on HN