13 ms·

The Line of Death

566 points by bpierre 10y ago

grenoire 10y ago
From a few weeks ago: https://twitter.com/tomscott/status/812265182646927361 https://twitter.com/tomscott/status/812265182646927361 This is a neat blog post that goes to show the extents of faking that can be done in the browser. More talks about this will hopefully lead to better "security UI" as the author puts it.
- karthikp 10y ago
  That was one of the most clever phishing attack that I've ever seen. I'm quite sure that if I wasn't aware of such attacks, I'd fall for it myself.
- vanderZwan 10y ago
  I have my browser default to non-standard zoom (150%). Assuming the fake attachments use a jpg instead of an SVG, they would look different. Not to mention miss the on-hover CSS. I wonder if I would notice it or not; something would probably feel off but not enough to fully register.
aashishkoirala 10y ago
With HTML5 push state navigation, can we really trust the address bar? Or is the domain part protected from that?
- lucideer 10y ago
  The domain part is protected from that, though as shown in grenoire's link there are other reasons to distrust the address bar.
lucideer 10y ago
One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers. ... will try and find a screenshot Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a1028.png https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a... Edit2: dom0 beat me to it below also Edit3: reword
- grenoire 10y ago
  Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
  - lucideer 10y ago
    Sorry, perhaps my comment was unclear. I meant "breaking" in a positive way (hence "best") - the UI crossed the line in a very significant and impossible-not-to-notice way. Still searching for a screenshot unfortunately... may just re-install it and take one myself.
    - dom0 10y ago
      http://schubiserv.de/images/opera-benutzerauthentifizierung.png http://schubiserv.de/images/opera-benutzerauthentifizierung....
      - niftich 10y ago
        I still disagree with both lucideer's original and improved wording, but I agree with their message, which praises Opera's basic auth UI as making it clear with the borders and 3D foreground overlay effect that it's a part of the browser-produced "trusted zone", and not the pool of untrusted content behind. Moreover, these kinds of UIs are still possible with the 'flat' look that's in vogue today, so there's little excuse why others choose not to do it. Perhaps one reason is that basic auth lost out early on to site-supplied login forms, so people got used to entering usernames and passwords into the page content anyway, instead of the browser UI. For the most part, basic auth only tends to affect uses like intranet sites, router login pages, web services, remote management pages -- settings where phishing can still cause (serious) damage, so a harder-to-fake UI would be beneficial nonetheless.
        lucideer 10y ago
        On my wording, apologies (edited). I was thinking of "breaking" in terms of "breaking/crossing a line/barrier one does not typically cross". Probably not the best wording in retrospect. On the comments on basic auth losing out, you might be right that that's a reason, but HTML5 APIs requiring some kind of UI confirmation from the user (like HTTP basic auth does) are far more proliferant than they once were (see http://permission.site/ http://permission.site/ for many examples), so I don't think that excuse is really good enough for browser vendors. Incidentally, it's worth noting that the UI for this kind of thing (user confirmation prompts) is pretty much a solved problem on mobile: these prompts tend to use the OS notification API, so always appear outside the browser chrome entirely.
ensignavenger 10y ago
It would be helpful if this post included mentions or links to any best practices to help mitigate this. Does anyone have any they would like to share?
- dsr_ 10y ago
  Here's one: don't use the default window manager theme. This is much easier on Linux and *BSD than in Windows or MacOS. I've seen lots of picture-in-picture attacks. They usually simulate Windows title bars and controls. Hah. I once saw one on a Mac which adapted to the OS and tried to show a Mac window frame, but it was an outdated version. That brings me to another point: send an incorrect User-Agent. Same browser on a different OS, perhaps.
  - userbinator 10y ago
    It used to be pretty easy to customise appearance on Windows, but the latest versions seem to have mostly castrated that functionality.
    - slobotron 10y ago
      Would you say that castrating window decorations was a misguided attempt by Microsoft to make Windows more like eunuchs? (I'll let myself out)
smacktoward 10y ago
This is an interesting case where security and design are in direct collision. From a security perspective you'd want the demarcation between the application itself and the untrusted content area to be as clear and obvious as possible, which would mean drawing big borders between them so thick nobody could possibly miss them. But contemporary design is all about being "clean," part of which involves making borders razor thin and so lightly colored you can barely see them. The example given of Chrome's line-of-death-crossing chevron is a good illustration of this tension. Say what you want to about it security-wise, but you can't say it's not clean!
- lucideer 10y ago
  I don't think I really agree with this. Making good visual design, or let's say in this case "clean" visual design, work is up to the designer. Taking for example the Opera 12 example I mentioned in comments above[0]: while I don't think Opera's overall UI design in 2011 was particularly visually pleasing, and certainly not as clean as Chrome's today, if you consider the UI pattern in isolation there's nothing preventing it from being done cleanly. Facebook uses the same UI pattern for the active state of its status input today. That's just one obvious example - I'm not suggesting it's the only one. Google's Material Design guidelines advocate a lot of context-crossing - the canonical example being the "Floating action button" attaching to sheets[1] [0] https://news.ycombinator.com/item?id=13400645 https://news.ycombinator.com/item?id=13400645 [1] https://material.io/guidelines/components/buttons-floating-action-button.html#buttons-floating-action-button-large-screens https://material.io/guidelines/components/buttons-floating-a...
bcjordan 10y ago
Speaking of zones of death, I was recently the (unsuccessful) target of a credit card gathering scam—on a Twitter ad, pretending to be Twitter. https://twitter.com/bcjordan/status/819894043870105602 https://twitter.com/bcjordan/status/819894043870105602 Multiple users actually entered their CC #s, two canceled them after they saw my reply to the tweet warning users. Incredibly, Twitter has still not notified the scammed users about it despite removing the ad after my report and multiple tweets to support requesting they notify the affected users. The fact that they allowed that ad to get through (essentially profiting from users identities and financial information being leaked?!) is just unbelievable, separate from their failure to protect/notify the users affected by the scam.
- madeofpalk 10y ago
  that is bonkers.
- djsumdog 10y ago
  I don't know why you'd need to scam people on Twitter. There are plenty of people who just post photos of their cards: https://twitter.com/needadebitcard https://twitter.com/needadebitcard
  - Theodores 10y ago
    That is excellent. My colleagues in ecommerce will have kittens over that. Sometimes we wonder if such and such country or such and such bank uses chip and pin. We can just test our online checkout to find out!!!
  - syphilis2 10y ago
    I was pleasantly surprised when my grandmother showed me her new chip credit card and it didn't have the numbers stamped on the front. They're instead printed on the back. I suspect the bank was getting sick of issuing new numbers after people inadvertently posted their own card numbers online.
  - jmkni 10y ago
    That's just depressing
throwawayish 10y ago
An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.
- greenrd 10y ago
  You can't embed control characters in URLs, though. Of course some web servers and web applications may blithely accept illegal unescaped control characters in URLs. If so, they're buggy.
  - throwawayish 10y ago
    if invalid(input): log.warning('UberForm field wrong: ' + input) (And many subtle variations thereof)
- henrikschroder 10y ago
  I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh http://example.com/script.sh | sh' or something, where if you pipe it to cat instead, it looks harmless enough, because it contains control characters that erase the dangerous parts. So you have to download the script, and load it up in an editor before you can see what it actually does. ...which of course is so much work that noone does it.
  - notriddle 10y ago
    Or open it in an actual text editor, like I do anyway to get syntax highlighting.
  - stable-point 10y ago
    Opening it in a text editor is not sufficient. With clever use of 'sleep' you can even have the server return a malicious payload only if it thinks its getting immediately piped to sh[0]. If you're opening it in a browser to check, you've also got to worry that the server may be looking at curl's user agent to decide whether to serve up a malicious payload[1]. [0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... [1] https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...
yosefk 10y ago
I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or the basic fact that different pixels are drawn by different programs, not to mention URL structure, or (gasp) Unicode and how it fits there, or how rnicrosoft.com isn't what they're looking for? What makes them understand this? Nothing. Software vendors are very happy with uninformed users (in fact these are the best users because they don't realize which of your programs and services can be replaced with an alternative and how), and users are very happy to stay uninformed, too. Not saying I know how to fix this, just that in my experience non-tech people are so completely unaware of what's going on that this "line of death" thing is not even a thing for them.
- userbinator 10y ago
  To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously different. With the setup I have, it's almost hilarious to see all the adverts with fake dialogs and buttons that look nothing like the real ones on my system; the font, the colours, the controls, everything stands out as being different.
  - enraged_camel 10y ago
    >>To fix this the answer is to educate the users I used to believe this too. Over the past several years though, I've worked with many, many users from all walks of life, and I've come to realize the hard truth: the users simply don't give a shit. They already use a billion other apps in their day-to-day work and don't have time to spend watching training videos or reading documentation. So if they have to be educated to be able to use your app properly, you've lost. This isn't to say that all users are like that. There are definitely ones who are tech-savvy and competent and curious. But the overwhelming majority want nothing other than to click a few buttons and get the results they want from the app. Anything more complex will cause them to give up and move on.
franciscop 10y ago
I have found a much worse case in mobile apps. I do not have Facebook App installed, so I get a prompt from some apps when I try to auth through facebook in-app to login into facebook, which could be totally fake.
kibwen 10y ago
I've never heard the term "line of death" used to describe this before, but this concept is exactly why I've sadly convinced myself that fully chromeless browsers are a bad idea. Unless there were some sort of spoofless hardware indicator that a given UI element was being displayed by the browser, I suppose... but that sort of defeats the purpose.
- inconclusive 10y ago
  What's a chromeless browser?
  - userbinator 10y ago
    Something like this: http://techcrunch.com/2014/11/28/yandex-brwoser-concept/ http://techcrunch.com/2014/11/28/yandex-brwoser-concept/ Discussed at https://news.ycombinator.com/item?id=8670503 https://news.ycombinator.com/item?id=8670503
- Flenser 10y ago
  How about, in the same way that some banks allow you to upload an image that they can then show you to prove you're talking to the same party that you've talked to previously, a chromeless browser could ask you to "draw" or supply an image for trusted actions. This "badge of trust" could then be show inside any dialog that asks the user to perform any action that you would not want a website to fake. It would of course be important that untrusted website content is never able to read these pixels. This is essentially inverting the relationship, by inserting a "zone of life" inside the "zone of death".
qume 10y ago
How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area. Also with a buffer so nothing too similar is allowed, or perhaps a warning comes up if something is close. I vote for something like the chrome dinosaur.
- deathanatos 10y ago
  Isn't this essentially the lock icon, today? What is "trusted"? We get the lock icon if a valid TLS connection is formed; if you want a more secure connection, you can get EV certificates. We could do away with the lock icon and only show a broken lock if not on TLS, and only show something that looks secure on EV certs, (which seems to be where browsers are headed.) A simple valid TLS connection getting the lock icon is problematic when people are using DNS names that are close-but-not-quite to things like paypal.com. And we want TLS certs to be issued automagically ala Let's Encrypt and such, so it's easy, unfortunately, to get a cert for paypal-not-quite.com. Such is the difference in "secure connection" and "a secure connection to a party you trust."
  - qume 10y ago
    Pretty much - except the rending engine won't let that block of pixels allow to hit the framebuffer
- laughinghan 10y ago
  > How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area. So in the blogpost announcing this distinctive icon, what does the screenshot look like?
rocqua 10y ago
The comment made about domain names not being trustworthy is why I like EV-certificates. Some people (notably google) argue that EV-certificates add very little of value because the user can just as easily check the domain name. Thing is, I could probably get some paypal or google like domain. Even if I can't, I could use a data URI as in [1] to put https://google.com https://google.com in the address bar. Compare that to EV. To get a browser to display google (or googel, or paypal), I'd need to convince a CA to issue such an EV cert. Whilst that might not be impossible, it takes something close to a state-level actor. A lot of phishers operate below that level. What EV gives over the domain name is a fully CA controlled part of the UI. Whilst the address bar is the 'zone of death by phisher' the EV bar is the 'zone of death by CIA/KGB'. [1] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/ https://www.wordfence.com/blog/2017/01/gmail-phishing-data-u...
JetSpiegel 10y ago
This is a truly dark pattern. https://textplain.files.wordpress.com/2017/01/image38.png?w=287&h=164 https://textplain.files.wordpress.com/2017/01/image38.png?w=... Faking browser popups is evil, and unexpected for a high-profile site such as Tom's Hardware.
- hlandau 10y ago
  What exactly does it accomplish, though, in this instance? Since it's not real it can't actually authorize anything the site can't already do. It's a dubious approach, but it seems more misguided than actively malicious.
  - owenversteeg 10y ago
    If they say no to the real thing, the site can't ask again. But of course they can present the fake one on every page as many times as they want until the user acquiesces. So once they click "yes" on the mini dialog, the page opens the real permissions dialog, because you can be much more certain that they'll allow it. Good TC article on the practice: https://techcrunch.com/2014/04/04/the-right-way-to-ask-users-for-ios-permissions/ https://techcrunch.com/2014/04/04/the-right-way-to-ask-users...
    - eriknstr 10y ago
      On iOS I think it is correct to first ask in app and then trigger the real thing if the user agrees because in an app there is a context that the app usually needs the permission so it makes sense and I feel it's nicer to ask me first inside the app and usually to explain why they need it at the same time than to take me straight to the real thing without warning because that puts me outside of the app. On websites it might have been ok if they asked in a proper way but presenting something that is pretending to be part of the browser UI when it isn't -- that is, as parent commenter said, a dark pattern.
  - gefh 10y ago
    Phishing, mainly.
jameshart 10y ago
Occurs to me that counteracting this problem might be one of the strengths of 3D UIs, such as we might have to look forward to in AR systems, or with display advances. Untrusted content can literally be loaded up and restricted to exist only 'inside' a chrome box, making its provenance clear. Of course, chances are that we'll get carried away with the possibilities of allowing AR web browsers to create arbitrary objects in the AR space long before we realize what a terrible idea that is...
dtjohnnymonkey 10y ago
Can someone explain the risk of something like Mac OS Mail asking for your gmail password? There's no address bar so I've wondered if I can really trust that I'm not handing my password to a MITM.
- toothbrush 10y ago
  Not an expert, so perhaps this isn't the only way. But i could envisage a malicious DNS server (such as in a coffee shop or airport, perhaps even an AP run by a malicious user inside Starbucks called "Starbucks RLY SRSLY") serving up mail.gmail.com A records that point to their own server, which listens on IMAP ports and logs usernames and passwords. For this to work, the application in question (such as Mail.app) would have to do a poor job of certificate trust verification. I am not familiar with how that works on OS X, but i'm assuming that it'd be somewhat hard (although not impossible) to obtain an SSL certificate for mail.gmail.com that a usual OS X installation would accept. Personally i tend to prefer the TOFU (trust on first use) way of doing things, after having connected on a (relatively) trusted internet connection, e.g., at home. If someone is more knowledgeable feel free to weigh in.
- karthikp 10y ago
  Google usually suggests that users create app specific passwords for anything that requires you to enter your Google credentials inside another app. If we follow this religiously, then the risk will be quite low
walrus01 10y ago
In my experience the ordinary user is no longer able to distinguish between a native binary that is running on their OS (example: the windows update feature of the win10 control panel) and data presented inside a browser window. witness the number of people who have fallen for the bsod scam sites and given away their CC info. https://www.google.com/search?q=bsod+scam+site&num=100&prmd=inv&source=lnms&tbm=isch&sa=X&ved=0ahUKEwiw-ti_g8PRAhUP1WMKHQhiC9oQ_AUIBygB https://www.google.com/search?q=bsod+scam+site&num=100&prmd=... Even when people see a scam where the UI obviously doesn't match with the OS, ignorant non technical people fall for it. People get those scam sites in safari on OSX and still click and pay.
inconclusive 10y ago
Why is there a line of death to begin with? The picture-in-picture attacks seem serious enough to warrant a new kind of browser.
- RugnirViking 10y ago
  How could we eliminate the line of death? There has to be a part of the page that we hand control to the site, otherwise there wouldn't be any content, and the line of death is just the boundaries of that.
gumernatorial 10y ago
Why can't browsers do image differencing to detect when the page contains something pretending to be the browser or OS chrome, and plaster warnings overtop?
- ambrop7 10y ago
  Surely it would have an unacceptable performance impact. Probably you'd need to run the matching in the GPU to get anything remotely useful, and you would literally kill battery life.
makecheck 10y ago
I thought Microsoft or somebody implemented a prototype for secure pop-ups where the windows had animated borders containing personal user information as a marquee? The idea was that this would be extremely difficult to fake (even if it looked a bit weird).
alexpete 10y ago
Something else to add, a Data URI can do this: https://twitter.com/tomscott/status/812268998742118400 https://twitter.com/tomscott/status/812268998742118400
emily008 10y ago
The line of death gave me life.
the8472 10y ago
Put the tab strip below the URL bar. This used to be the case in the past. That'll leave plenty of room to have things drop down from the URL bar without much ambiguity.
xg15 10y ago
> Unfortunately, on windowed operating systems, this is worse than it sounds, because it creates the possibility of picture-in-picture attacks, where an entire browser window, including its trusted pixels, can be faked [...] They retorted “Well, we passed this screenshot around our entire information security department, and nobody could tell it’s a picture-in-picture attack. Can you?” Maybe I'm naive, but shouldn't you be able to detect picture-in-picture attacks rather easily because you never opened that window in the first place? Additionally, the "chrome" of the picture-in-picture would behave significantly than a real chrome. I feel both of those points can't be assessed by showing people a screenshot, because people have significantly different expectations when looking at a screenshot of a website than when browsing a website by themselves.
- breakingcups 10y ago
  A few websites I know will pop up a separate window for entering credit card credentials.
agumonkey 10y ago
I can't thank this article enough for raising a stupidly simple yet very generic problem.
Herrera 10y ago
I was playing with picture-in-picture attacks on Chrome some time ago and even proposed a way for mitigation, but it was dismissed. Here's the PoC I did: https://www.youtube.com/watch?v=0oega6C5SF0 https://www.youtube.com/watch?v=0oega6C5SF0 And the mitigation I proposed was from this: http://i.imgur.com/8m6UdiC.png http://i.imgur.com/8m6UdiC.png To this: http://i.imgur.com/turRAdc.png http://i.imgur.com/turRAdc.png
teapejon 10y ago
Oh my grandma what big teeth you have!

566 points by bpierre 10y ago

From a few weeks ago: https://twitter.com/tomscott/status/812265182646927361 https://twitter.com/tomscott/status/812265182646927361 This is a neat blog post that goes to show the extents of faking that can be done in the browser. More talks about this will hopefully lead to better "security UI" as the author puts it.

karthikp 10y ago
That was one of the most clever phishing attack that I've ever seen. I'm quite sure that if I wasn't aware of such attacks, I'd fall for it myself.
vanderZwan 10y ago
I have my browser default to non-standard zoom (150%). Assuming the fake attachments use a jpg instead of an SVG, they would look different. Not to mention miss the on-hover CSS. I wonder if I would notice it or not; something would probably feel off but not enough to fully register.

aashishkoirala 10y ago

With HTML5 push state navigation, can we really trust the address bar? Or is the domain part protected from that?

lucideer 10y ago
The domain part is protected from that, though as shown in grenoire's link there are other reasons to distrust the address bar.

lucideer 10y ago

One of the best UIs I've seen crossing over this line of death was the HTTP Basic Auth popdown in Opera 12. I've always wondered why that UI concept was never taken up by other browsers. ... will try and find a screenshot Edit: Couldn't find one so just installed it myself: https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a1028.png https://pageshot.net/images/4af15a26-6eb8-45a2-b4d5-ed6ea19a... Edit2: dom0 beat me to it below also Edit3: reword

grenoire 10y ago
Both Chrome and Firefox are under the line of death too. Although for Firefox it is a bit trickier to replicate as it uses native components whereas Chrome uses its internal UI kit.
- lucideer 10y ago
  Sorry, perhaps my comment was unclear. I meant "breaking" in a positive way (hence "best") - the UI crossed the line in a very significant and impossible-not-to-notice way. Still searching for a screenshot unfortunately... may just re-install it and take one myself.
  - dom0 10y ago
    http://schubiserv.de/images/opera-benutzerauthentifizierung.png http://schubiserv.de/images/opera-benutzerauthentifizierung....
    - niftich 10y ago
      I still disagree with both lucideer's original and improved wording, but I agree with their message, which praises Opera's basic auth UI as making it clear with the borders and 3D foreground overlay effect that it's a part of the browser-produced "trusted zone", and not the pool of untrusted content behind. Moreover, these kinds of UIs are still possible with the 'flat' look that's in vogue today, so there's little excuse why others choose not to do it. Perhaps one reason is that basic auth lost out early on to site-supplied login forms, so people got used to entering usernames and passwords into the page content anyway, instead of the browser UI. For the most part, basic auth only tends to affect uses like intranet sites, router login pages, web services, remote management pages -- settings where phishing can still cause (serious) damage, so a harder-to-fake UI would be beneficial nonetheless.
      - lucideer 10y ago
        On my wording, apologies (edited). I was thinking of "breaking" in terms of "breaking/crossing a line/barrier one does not typically cross". Probably not the best wording in retrospect. On the comments on basic auth losing out, you might be right that that's a reason, but HTML5 APIs requiring some kind of UI confirmation from the user (like HTTP basic auth does) are far more proliferant than they once were (see http://permission.site/ http://permission.site/ for many examples), so I don't think that excuse is really good enough for browser vendors. Incidentally, it's worth noting that the UI for this kind of thing (user confirmation prompts) is pretty much a solved problem on mobile: these prompts tend to use the OS notification API, so always appear outside the browser chrome entirely.

ensignavenger 10y ago

It would be helpful if this post included mentions or links to any best practices to help mitigate this. Does anyone have any they would like to share?

dsr_ 10y ago
Here's one: don't use the default window manager theme. This is much easier on Linux and *BSD than in Windows or MacOS. I've seen lots of picture-in-picture attacks. They usually simulate Windows title bars and controls. Hah. I once saw one on a Mac which adapted to the OS and tried to show a Mac window frame, but it was an outdated version. That brings me to another point: send an incorrect User-Agent. Same browser on a different OS, perhaps.
- userbinator 10y ago
  It used to be pretty easy to customise appearance on Windows, but the latest versions seem to have mostly castrated that functionality.
  - slobotron 10y ago
    Would you say that castrating window decorations was a misguided attempt by Microsoft to make Windows more like eunuchs? (I'll let myself out)

smacktoward 10y ago

This is an interesting case where security and design are in direct collision. From a security perspective you'd want the demarcation between the application itself and the untrusted content area to be as clear and obvious as possible, which would mean drawing big borders between them so thick nobody could possibly miss them. But contemporary design is all about being "clean," part of which involves making borders razor thin and so lightly colored you can barely see them. The example given of Chrome's line-of-death-crossing chevron is a good illustration of this tension. Say what you want to about it security-wise, but you can't say it's not clean!

lucideer 10y ago
I don't think I really agree with this. Making good visual design, or let's say in this case "clean" visual design, work is up to the designer. Taking for example the Opera 12 example I mentioned in comments above[0]: while I don't think Opera's overall UI design in 2011 was particularly visually pleasing, and certainly not as clean as Chrome's today, if you consider the UI pattern in isolation there's nothing preventing it from being done cleanly. Facebook uses the same UI pattern for the active state of its status input today. That's just one obvious example - I'm not suggesting it's the only one. Google's Material Design guidelines advocate a lot of context-crossing - the canonical example being the "Floating action button" attaching to sheets[1] [0] https://news.ycombinator.com/item?id=13400645 https://news.ycombinator.com/item?id=13400645 [1] https://material.io/guidelines/components/buttons-floating-action-button.html#buttons-floating-action-button-large-screens https://material.io/guidelines/components/buttons-floating-a...

bcjordan 10y ago

Speaking of zones of death, I was recently the (unsuccessful) target of a credit card gathering scam—on a Twitter ad, pretending to be Twitter. https://twitter.com/bcjordan/status/819894043870105602 https://twitter.com/bcjordan/status/819894043870105602 Multiple users actually entered their CC #s, two canceled them after they saw my reply to the tweet warning users. Incredibly, Twitter has still not notified the scammed users about it despite removing the ad after my report and multiple tweets to support requesting they notify the affected users. The fact that they allowed that ad to get through (essentially profiting from users identities and financial information being leaked?!) is just unbelievable, separate from their failure to protect/notify the users affected by the scam.

madeofpalk 10y ago
that is bonkers.
djsumdog 10y ago
I don't know why you'd need to scam people on Twitter. There are plenty of people who just post photos of their cards: https://twitter.com/needadebitcard https://twitter.com/needadebitcard
- Theodores 10y ago
  That is excellent. My colleagues in ecommerce will have kittens over that. Sometimes we wonder if such and such country or such and such bank uses chip and pin. We can just test our online checkout to find out!!!
- syphilis2 10y ago
  I was pleasantly surprised when my grandmother showed me her new chip credit card and it didn't have the numbers stamped on the front. They're instead printed on the back. I suspect the bank was getting sick of issuing new numbers after people inadvertently posted their own card numbers online.
- jmkni 10y ago
  That's just depressing

throwawayish 10y ago

An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.

greenrd 10y ago
You can't embed control characters in URLs, though. Of course some web servers and web applications may blithely accept illegal unescaped control characters in URLs. If so, they're buggy.
- throwawayish 10y ago
  if invalid(input): log.warning('UberForm field wrong: ' + input) (And many subtle variations thereof)
henrikschroder 10y ago
I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh http://example.com/script.sh | sh' or something, where if you pipe it to cat instead, it looks harmless enough, because it contains control characters that erase the dangerous parts. So you have to download the script, and load it up in an editor before you can see what it actually does. ...which of course is so much work that noone does it.
- notriddle 10y ago
  Or open it in an actual text editor, like I do anyway to get syntax highlighting.
- stable-point 10y ago
  Opening it in a text editor is not sufficient. With clever use of 'sleep' you can even have the server return a malicious payload only if it thinks its getting immediately piped to sh[0]. If you're opening it in a browser to check, you've also got to worry that the server may be looking at curl's user agent to decide whether to serve up a malicious payload[1]. [0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... [1] https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...

yosefk 10y ago

I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or the basic fact that different pixels are drawn by different programs, not to mention URL structure, or (gasp) Unicode and how it fits there, or how rnicrosoft.com isn't what they're looking for? What makes them understand this? Nothing. Software vendors are very happy with uninformed users (in fact these are the best users because they don't realize which of your programs and services can be replaced with an alternative and how), and users are very happy to stay uninformed, too. Not saying I know how to fix this, just that in my experience non-tech people are so completely unaware of what's going on that this "line of death" thing is not even a thing for them.

userbinator 10y ago
To fix this the answer is to educate the users, and also oppose this style of UI that makes things opaque and hard to comprehend. (Maybe when users are better educated they will automatically find the problems with such UI and thus further oppose it.) Incidentally, if users customised their environments more, they would be far less likely to be fooled by fake dialogs and such, because they would look very obviously different. With the setup I have, it's almost hilarious to see all the adverts with fake dialogs and buttons that look nothing like the real ones on my system; the font, the colours, the controls, everything stands out as being different.
- enraged_camel 10y ago
  >>To fix this the answer is to educate the users I used to believe this too. Over the past several years though, I've worked with many, many users from all walks of life, and I've come to realize the hard truth: the users simply don't give a shit. They already use a billion other apps in their day-to-day work and don't have time to spend watching training videos or reading documentation. So if they have to be educated to be able to use your app properly, you've lost. This isn't to say that all users are like that. There are definitely ones who are tech-savvy and competent and curious. But the overwhelming majority want nothing other than to click a few buttons and get the results they want from the app. Anything more complex will cause them to give up and move on.

franciscop 10y ago

I have found a much worse case in mobile apps. I do not have Facebook App installed, so I get a prompt from some apps when I try to auth through facebook in-app to login into facebook, which could be totally fake.

kibwen 10y ago

I've never heard the term "line of death" used to describe this before, but this concept is exactly why I've sadly convinced myself that fully chromeless browsers are a bad idea. Unless there were some sort of spoofless hardware indicator that a given UI element was being displayed by the browser, I suppose... but that sort of defeats the purpose.

inconclusive 10y ago
What's a chromeless browser?
- userbinator 10y ago
  Something like this: http://techcrunch.com/2014/11/28/yandex-brwoser-concept/ http://techcrunch.com/2014/11/28/yandex-brwoser-concept/ Discussed at https://news.ycombinator.com/item?id=8670503 https://news.ycombinator.com/item?id=8670503
Flenser 10y ago
How about, in the same way that some banks allow you to upload an image that they can then show you to prove you're talking to the same party that you've talked to previously, a chromeless browser could ask you to "draw" or supply an image for trusted actions. This "badge of trust" could then be show inside any dialog that asks the user to perform any action that you would not want a website to fake. It would of course be important that untrusted website content is never able to read these pixels. This is essentially inverting the relationship, by inserting a "zone of life" inside the "zone of death".

qume 10y ago

How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area. Also with a buffer so nothing too similar is allowed, or perhaps a warning comes up if something is close. I vote for something like the chrome dinosaur.

deathanatos 10y ago
Isn't this essentially the lock icon, today? What is "trusted"? We get the lock icon if a valid TLS connection is formed; if you want a more secure connection, you can get EV certificates. We could do away with the lock icon and only show a broken lock if not on TLS, and only show something that looks secure on EV certs, (which seems to be where browsers are headed.) A simple valid TLS connection getting the lock icon is problematic when people are using DNS names that are close-but-not-quite to things like paypal.com. And we want TLS certs to be issued automagically ala Let's Encrypt and such, so it's easy, unfortunately, to get a cert for paypal-not-quite.com. Such is the difference in "secure connection" and "a secure connection to a party you trust."
- qume 10y ago
  Pretty much - except the rending engine won't let that block of pixels allow to hit the framebuffer
laughinghan 10y ago
> How about we put a distinctive icon in the trusted zones, which the renderer won't allow under any circumstances in the untrusted area. So in the blogpost announcing this distinctive icon, what does the screenshot look like?

rocqua 10y ago

The comment made about domain names not being trustworthy is why I like EV-certificates. Some people (notably google) argue that EV-certificates add very little of value because the user can just as easily check the domain name. Thing is, I could probably get some paypal or google like domain. Even if I can't, I could use a data URI as in [1] to put https://google.com https://google.com in the address bar. Compare that to EV. To get a browser to display google (or googel, or paypal), I'd need to convince a CA to issue such an EV cert. Whilst that might not be impossible, it takes something close to a state-level actor. A lot of phishers operate below that level. What EV gives over the domain name is a fully CA controlled part of the UI. Whilst the address bar is the 'zone of death by phisher' the EV bar is the 'zone of death by CIA/KGB'. [1] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/ https://www.wordfence.com/blog/2017/01/gmail-phishing-data-u...

JetSpiegel 10y ago

This is a truly dark pattern. https://textplain.files.wordpress.com/2017/01/image38.png?w=287&h=164 https://textplain.files.wordpress.com/2017/01/image38.png?w=... Faking browser popups is evil, and unexpected for a high-profile site such as Tom's Hardware.

hlandau 10y ago
What exactly does it accomplish, though, in this instance? Since it's not real it can't actually authorize anything the site can't already do. It's a dubious approach, but it seems more misguided than actively malicious.
- owenversteeg 10y ago
  If they say no to the real thing, the site can't ask again. But of course they can present the fake one on every page as many times as they want until the user acquiesces. So once they click "yes" on the mini dialog, the page opens the real permissions dialog, because you can be much more certain that they'll allow it. Good TC article on the practice: https://techcrunch.com/2014/04/04/the-right-way-to-ask-users-for-ios-permissions/ https://techcrunch.com/2014/04/04/the-right-way-to-ask-users...
  - eriknstr 10y ago
    On iOS I think it is correct to first ask in app and then trigger the real thing if the user agrees because in an app there is a context that the app usually needs the permission so it makes sense and I feel it's nicer to ask me first inside the app and usually to explain why they need it at the same time than to take me straight to the real thing without warning because that puts me outside of the app. On websites it might have been ok if they asked in a proper way but presenting something that is pretending to be part of the browser UI when it isn't -- that is, as parent commenter said, a dark pattern.
- gefh 10y ago
  Phishing, mainly.

jameshart 10y ago

Occurs to me that counteracting this problem might be one of the strengths of 3D UIs, such as we might have to look forward to in AR systems, or with display advances. Untrusted content can literally be loaded up and restricted to exist only 'inside' a chrome box, making its provenance clear. Of course, chances are that we'll get carried away with the possibilities of allowing AR web browsers to create arbitrary objects in the AR space long before we realize what a terrible idea that is...

dtjohnnymonkey 10y ago

Can someone explain the risk of something like Mac OS Mail asking for your gmail password? There's no address bar so I've wondered if I can really trust that I'm not handing my password to a MITM.

toothbrush 10y ago
Not an expert, so perhaps this isn't the only way. But i could envisage a malicious DNS server (such as in a coffee shop or airport, perhaps even an AP run by a malicious user inside Starbucks called "Starbucks RLY SRSLY") serving up mail.gmail.com A records that point to their own server, which listens on IMAP ports and logs usernames and passwords. For this to work, the application in question (such as Mail.app) would have to do a poor job of certificate trust verification. I am not familiar with how that works on OS X, but i'm assuming that it'd be somewhat hard (although not impossible) to obtain an SSL certificate for mail.gmail.com that a usual OS X installation would accept. Personally i tend to prefer the TOFU (trust on first use) way of doing things, after having connected on a (relatively) trusted internet connection, e.g., at home. If someone is more knowledgeable feel free to weigh in.
karthikp 10y ago
Google usually suggests that users create app specific passwords for anything that requires you to enter your Google credentials inside another app. If we follow this religiously, then the risk will be quite low

walrus01 10y ago

In my experience the ordinary user is no longer able to distinguish between a native binary that is running on their OS (example: the windows update feature of the win10 control panel) and data presented inside a browser window. witness the number of people who have fallen for the bsod scam sites and given away their CC info. https://www.google.com/search?q=bsod+scam+site&num=100&prmd=inv&source=lnms&tbm=isch&sa=X&ved=0ahUKEwiw-ti_g8PRAhUP1WMKHQhiC9oQ_AUIBygB https://www.google.com/search?q=bsod+scam+site&num=100&prmd=... Even when people see a scam where the UI obviously doesn't match with the OS, ignorant non technical people fall for it. People get those scam sites in safari on OSX and still click and pay.

inconclusive 10y ago

Why is there a line of death to begin with? The picture-in-picture attacks seem serious enough to warrant a new kind of browser.

RugnirViking 10y ago
How could we eliminate the line of death? There has to be a part of the page that we hand control to the site, otherwise there wouldn't be any content, and the line of death is just the boundaries of that.

gumernatorial 10y ago

Why can't browsers do image differencing to detect when the page contains something pretending to be the browser or OS chrome, and plaster warnings overtop?

ambrop7 10y ago
Surely it would have an unacceptable performance impact. Probably you'd need to run the matching in the GPU to get anything remotely useful, and you would literally kill battery life.

makecheck 10y ago

I thought Microsoft or somebody implemented a prototype for secure pop-ups where the windows had animated borders containing personal user information as a marquee? The idea was that this would be extremely difficult to fake (even if it looked a bit weird).

alexpete 10y ago

Something else to add, a Data URI can do this: https://twitter.com/tomscott/status/812268998742118400 https://twitter.com/tomscott/status/812268998742118400

emily008 10y ago

The line of death gave me life.

the8472 10y ago

Put the tab strip below the URL bar. This used to be the case in the past. That'll leave plenty of room to have things drop down from the URL bar without much ambiguity.

xg15 10y ago

> Unfortunately, on windowed operating systems, this is worse than it sounds, because it creates the possibility of picture-in-picture attacks, where an entire browser window, including its trusted pixels, can be faked [...] They retorted “Well, we passed this screenshot around our entire information security department, and nobody could tell it’s a picture-in-picture attack. Can you?” Maybe I'm naive, but shouldn't you be able to detect picture-in-picture attacks rather easily because you never opened that window in the first place? Additionally, the "chrome" of the picture-in-picture would behave significantly than a real chrome. I feel both of those points can't be assessed by showing people a screenshot, because people have significantly different expectations when looking at a screenshot of a website than when browsing a website by themselves.

breakingcups 10y ago
A few websites I know will pop up a separate window for entering credit card credentials.

agumonkey 10y ago

I can't thank this article enough for raising a stupidly simple yet very generic problem.

Herrera 10y ago

I was playing with picture-in-picture attacks on Chrome some time ago and even proposed a way for mitigation, but it was dismissed. Here's the PoC I did: https://www.youtube.com/watch?v=0oega6C5SF0 https://www.youtube.com/watch?v=0oega6C5SF0 And the mitigation I proposed was from this: http://i.imgur.com/8m6UdiC.png http://i.imgur.com/8m6UdiC.png To this: http://i.imgur.com/turRAdc.png http://i.imgur.com/turRAdc.png

teapejon 10y ago

Oh my grandma what big teeth you have!