Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Line of Death

textslashplain.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: The Line of Death

#61

Post by systoll »

ams6110 wrote: post #29
userbinator wrote: post #23

Earlier quoted context omitted.

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…

Back when it was still possible (Windows XP? Maybe Windows 7?) I would always turn off all the modern Windows chrome and animation and make it look like Windows 2000. Made for better responsiveness and as you say, you could spot fake dialog boxes in an instant. Not a Windows user these days but I understand it's not possible to get the old Windows 2000 look anymore, though I'm sure you can still change color themes a…

I'd say windows 10 almost brings things back to the Windows 2000 era in this respect. Changing the wallpaper changes the accent colour (or you can pick one seperately), and you can choose whether titlebars have that accent.

A fake dialog won't know that my titlebars and buttons should be teal.

Re: The Line of Death

#62

Post by toothbrush »

dtjohnnymonkey wrote: post #46

Can someone explain the risk of something like Mac OS Mail asking for your gmail password? There's no address bar so I've wondered if I can really trust that I'm not handing my password to a MITM.

Not an expert, so perhaps this isn't the only way. But i could envisage a malicious DNS server (such as in a coffee shop or airport, perhaps even an AP run by a malicious user inside Starbucks called "Starbucks RLY SRSLY") serving up mail.gmail.com A records that point to their own server, which listens on IMAP ports and logs usernames and passwords. For this to work, the application in question (such as Mail.app) would have to do a poor job of certificate trust verification. I am not familiar with how that works on OS X, but i'm assuming that it'd be somewhat hard (although not impossible) to obtain an SSL certificate for mail.gmail.com that a usual OS X installation would accept. Personally i tend to prefer the TOFU (trust on first use) way of doing things, after having connected on a (relatively) trusted internet connection, e.g., at home. If someone is more knowledgeable feel free to weigh in.

Re: The Line of Death

#63

Post by gefh »

hlandau wrote: post #33
JetSpiegel wrote: post #31

This is a truly dark pattern. https://textplain.files.wordpress.com/2017/01/image38.png?w=... Faking browser popups is evil, and unexpected for a high-profile site such as Tom's Hardware.

What exactly does it accomplish, though, in this instance? Since it's not real it can't actually authorize anything the site can't already do. It's a dubious approach, but it seems more misguided than actively malicious.

Phishing, mainly.

Re: The Line of Death

#64

Post by makecheck »

I thought Microsoft or somebody implemented a prototype for secure pop-ups where the windows had animated borders containing personal user information as a marquee? The idea was that this would be extremely difficult to fake (even if it looked a bit weird).

Re: The Line of Death

#66

Post by userbinator »

inconclusive wrote: post #53
kibwen wrote: post #20

I've never heard the term "line of death" used to describe this before, but this concept is exactly why I've sadly convinced myself that fully chromeless browsers are a bad idea. Unless there were some sort of spoofless hardware indicator that a given UI element was being displayed by the browser, I suppose... but that sort of defeats the purpose.

What's a chromeless browser?

Something like this: http://techcrunch.com/2014/11/28/yandex-brwoser-concept/

Discussed at https://news.ycombinator.com/item?id=8670503

Re: The Line of Death

#67

Post by eriknstr »

owenversteeg wrote: post #36
hlandau wrote: post #33

Earlier quoted context omitted.

What exactly does it accomplish, though, in this instance? Since it's not real it can't actually authorize anything the site can't already do. It's a dubious approach, but it seems more misguided than actively malicious.

If they say no to the real thing, the site can't ask again. But of course they can present the fake one on every page as many times as they want until the user acquiesces. So once they click "yes" on the mini dialog, the page opens the real permissions dialog, because you can be much more certain that they'll allow it. Good TC article on the practice: https://techcrunch.com/2014/04/04/the-right-way-to-ask-users...

On iOS I think it is correct to first ask in app and then trigger the real thing if the user agrees because in an app there is a context that the app usually needs the permission so it makes sense and I feel it's nicer to ask me first inside the app and usually to explain why they need it at the same time than to take me straight to the real thing without warning because that puts me outside of the app. On websites it might have been ok if they asked in a proper way but presenting something that is pretending to be part of the browser UI when it isn't -- that is, as parent commenter said, a dark pattern.

Re: The Line of Death

#68

Post by angersock »

BurningFrog wrote: post #45
enraged_camel wrote: post #28

Earlier quoted context omitted.

>>To fix this the answer is to educate the users I used to believe this too. Over the past several years though, I've worked with many, many users from all walks of life, and I've come to realize the hard truth: the users simply don't give a shit. They already use a billion other apps in their day-to-day work and don't have time to spend watching training videos or reading documentation. So if they have to be educate…

Another way to think about the same thing. The user is the boss of the software. The user is not a peripheral that I get to reprogram. I must accept the user as is, and adapt as best as possible to their actual capabilities.

Counteranalogy: If you have a shitty boss, it makes sense to interpret their directions in the way that is most convenient.

If users with to abdicate their positions as bosses, then they clearly are not to be considered as having valid authority.

Re: The Line of Death

#69

Post by notriddle »

Stratoscope wrote: post #43
notriddle wrote: post #38

Earlier quoted context omitted.

Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?). Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.

That problem is easily solved. In your malware, simply use the default settings for all of those things, and you will catch the 97% of users who never customize any of it. You can afford to lose the remaining 3%.

The title bar thing, yes.

The accent color? If you buy a new Windows 10 machine off the shelf, after you enter your name, it asks what your favorite color is. I think blue is highlighted when that screen comes up, but you can't miss the opportunity, so 3% is a bit low for an estimate of how many people will change it.

Re: The Line of Death

#70

Post by xenadu02 »

userbinator wrote: post #23
yosefk wrote: post #15

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or th…

To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously d…

>To fix this the answer is to educate the users

That's like saying the fix for road deaths is to educate drivers. We already proved that doesn't work nearly as well as designing better cars, roads, and signs.

Educating 7 billion human beings is a lot of work. A mind-bogglingly insane amount of work. Security is even worse because one lapse in judgement, one sick or busy day, can completely erase a lifetime of following security best-practices.

The power of software is the power to make machines do the work. Why would we want to make 7 billion people take responsibility for a problem that could be solved by a few thousand programmers?

Post reply on HN