Cursory hack – Fake address bar interaction
jameshfisher.github.io
Cursory hack – Fake address bar interaction
1–10 of 42 posts
Re: Cursory hack – Fake address bar interaction
#2Unless I'm completely getting myself confused then it's doing something I didn't think was possible and drawing over the browser chrome.
Can anyone explain what's going on here.
Re: Cursory hack – Fake address bar interaction
#3Unless I'm completely getting myself confused then it's doing something I didn't think was possible and drawing over the browser chrome. Can anyone explain what's going on here.
Curious about this as well, didn't think you could escape the viewport but clearly it was overlaying the lock icon in my address bar.
The tracking wasn't great, but maybe that was intentional to illustrate a point.
Re: Cursory hack – Fake address bar interaction
#4Link to the source on github for anyone else without a view source button:
https://github.com/jameshfisher/cursory-hack/blob/gh-pages/i...
It's using a canvas to draw the address bar and adjusting the position every time the mouse moves, but I don't understand the details of it
Re: Cursory hack – Fake address bar interaction
#5Unless I'm completely getting myself confused then it's doing something I didn't think was possible and drawing over the browser chrome. Can anyone explain what's going on here.
After a first look, it seems like this hack involves setting a custom cursor, which is defined as a canvas image that is 128 px tall. This 128px high image is mostly transparent, and has a fake "cursor" image at the top of it. The bottom of this image tracks your real cursor, and the fake cursor at the top of the image makes it seem like your real cursor is hovering over the browser chrome, when in fact it is ~128px lower than it appears. The rest of the effect is achieved via animating the canvas used for the custom cursor.
In terms of mitigation, it seems like at a minimum custom cursors should never be rendered outside the bounds of the page content.
Re: Cursory hack – Fake address bar interaction
#6[deleted]
Re: Cursory hack – Fake address bar interaction
#7Before you click on that remember.
Alt + Left
to go back :P
Re: Cursory hack – Fake address bar interaction
#8Credit where it's due. It seems this is illustrating a sinister use of the original code found here:
Re: Cursory hack – Fake address bar interaction
#9Doesn't seem to work in Safari.
Re: Cursory hack – Fake address bar interaction
#10So I thought this was just doing something on click (showing the fake HTTPS info), but that it maybe didn't work on newer or non-Chrome browsers, e.g. Chrome 52, Safari 9.1, and whatever bug was fixed there. But then I noticed that it causes really weird interactions at the top of the browser, at least on Mac; if you open the page in either Chrome or Safari and move your mouse towards the address bar, it jumps around on Safari and does a "double take" on Chrome. Really interesting!