1–10 of 26 posts
I played around with libvips and can easily create a png with any text.
vips text x.png "1,234,567" --width 100 --align centre --dpi 340
Any thoughts on why this shouldn't be done?
> This would ensure scammers can't just go in and edit the html on the fly
How would the scammers "edit the HTML on the fly" of a bank's website that they don't control...?
If they can control it somehow (either via a hack, local malware, browser extension, or just hand-editing the site on the victim's computer)... well, they can just as easily replace your PNG with one of their own, or just replace it with regular HTML numbers.
If someone can control the bank website, it's game over. It's not a matter of graphics vs text?
2. Scammers can fake PNGs just like HTML.
I don't understand your threat model: > This would ensure scammers can't just go in and edit the html on the fly How would the scammers "edit the HTML on the fly" of a bank's website that they don't control...? If they can control it somehow (either via a hack, local malware, browser extension, or just hand-editing the site on the victim's computer)... well, they can just as easily replace your PNG with one of their…
1. This would break accessibility requirements. 2. Scammers can fake PNGs just like HTML.
I don't understand your threat model: > This would ensure scammers can't just go in and edit the html on the fly How would the scammers "edit the HTML on the fly" of a bank's website that they don't control...? If they can control it somehow (either via a hack, local malware, browser extension, or just hand-editing the site on the victim's computer)... well, they can just as easily replace your PNG with one of their…
They ask a person to login to their bank account with screen sharing. They then take control of the mouse and edit the HTML on the fly making it look like they transferred a large amount to the bank account. Now they ask the person to wire money back or they will lose their job.
If they wanted to edit the HTML for some reason, it's trivial to just use their own image or replace the with their own text.
The prevention for this isn't to render texts as image, but not to screen share your computer with random people online, much less hand mouse control over to them while you're logged in to your bank. If it's some elderly person doing this or the such, you should really teach them better or they'll get scammed from much less esoteric threats :(
Then how do access people with vision problems the website? Afaik only the banks in Germany use FINTS for banking
1. This would break accessibility requirements. 2. Scammers can fake PNGs just like HTML.
I'll give you accessibility. I tried changing images in the browser on the fly and it just hides the image. That's probably because the browser would need to make a new GET request.
Earlier quoted context omitted.
They ask a person to login to their bank account with screen sharing. They then take control of the mouse and edit the HTML on the fly making it look like they transferred a large amount to the bank account. Now they ask the person to wire money back or they will lose their job.
If they already control your browser, they don't have to edit the HTML and fake anything. They can just transfer money to themselves from your account... If they wanted to edit the HTML for some reason, it's trivial to just use their own image or replace the with their own text. The prevention for this isn't to render texts as image, but not to screen share your computer with random people online, much less hand mous…