4 ms·
Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?). Since
by notriddle 10y ago
Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?).
Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.
- Stratoscope 10y agoThat problem is easily solved. In your malware, simply use the default settings for all of those things, and you will catch the 97% of users who never customize any of it. You can afford to lose the remaining 3%.
- madeofpalk 10y agoIt's also a bit self selecting - there's a lower chance those that change the defaults will fall for these attacks anyway.
- notriddle 10y agoThe title bar thing, yes. The accent color? If you buy a new Windows 10 machine off the shelf, after you enter your name, it asks what your favorite color is. I think blue is highlighted when that screen comes up, but you can't miss the opportunity, so 3% is a bit low for an estimate of how many people will change it.
- throwawayish 10y agoFavourite colors don't follow a random distribution. IIRC with blue and green you already have two thirds of the population.
- notriddle 10y agoA browser ad that imitates a windows dialog can only guess one color per impression. Forcing Mallory to settle for 1/3 of the otherwise-vulnerable population is a definite improvement.
- dwe3000 10y agoCSS System Colors support[1] in Windows/IE makes this harder to stop than you many realize. I don't see it very much anymore, but when it first came out, I saw quite a bit of this. [1]: http://www.w3.org/TR/css3-color/#css2-system http://www.w3.org/TR/css3-color/#css2-system