51–60 of 108 posts
Earlier quoted context omitted.
Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
It's actually subtly above the line of death in Chrome: https://i.imgur.com/dEootju.png And Firefox greys out some browser chrome: https://i.imgur.com/JfJ57qA.gif But these things are probably not going to be noticed by your average user...
The picture-in-picture attacks seem serious enough to warrant a new kind of browser.
I've never heard the term "line of death" used to describe this before, but this concept is exactly why I've sadly convinced myself that fully chromeless browsers are a bad idea. Unless there were some sort of spoofless hardware indicator that a given UI element was being displayed by the browser, I suppose... but that sort of defeats the purpose.
Earlier quoted context omitted.
Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?). Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.
That problem is easily solved. In your malware, simply use the default settings for all of those things, and you will catch the 97% of users who never customize any of it. You can afford to lose the remaining 3%.
I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…
All these browsers have that darn Modal dialog alert that lets the code below the line of death trap you on their site. Definitely a disconnect with the plight of their users.
Also worth nothing that in Safari the modals don't block the rest of the browser (I believe at least Firefox does this as well?) and are fully contained to its own tab.
I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…
Take MFA for example - absolute 'usability' nightmare! Makes your product many many times harder to use and fails horrible under fairly common use cases (like that time I had to mail in a certified copy of my ID overseas to AWS to regain access to our root account).
Speaking of zones of death, I was recently the (unsuccessful) target of a credit card gathering scam—on a Twitter ad, pretending to be Twitter . https://twitter.com/bcjordan/status/819894043870105602 Multiple users actually entered their CC #s, two canceled them after they saw my reply to the tweet warning users. Incredibly, Twitter has still not notified the scammed users about it despite removing the ad after my re…
I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…
All these browsers have that darn Modal dialog alert that lets the code below the line of death trap you on their site. Definitely a disconnect with the plight of their users.
Speaking of zones of death, I was recently the (unsuccessful) target of a credit card gathering scam—on a Twitter ad, pretending to be Twitter . https://twitter.com/bcjordan/status/819894043870105602 Multiple users actually entered their CC #s, two canceled them after they saw my reply to the tweet warning users. Incredibly, Twitter has still not notified the scammed users about it despite removing the ad after my re…