4 ms·

I think this issue signals a problem with the UI in Chrome or Firefox, or any browser that creates this kind of popup. The problem is that, by placing the popup

by rg3 16y ago

I think this issue signals a problem with the UI in Chrome or Firefox, or any browser that creates this kind of popup. The problem is that, by placing the popup above the webpage contents, the webpage creators can mimic that native UI and create the same effect with the page contents themselves, and you don't know if the popup was created by the browser itself or if it's part of the webpage. I think the problem could be solved by modifying the UI in the browser in such a way that you don't allow the webpage to create a similar popup because there would be a visual barrier that clearly indicates when the popup is part of the browser itself and when it's not.

pavs 16y ago
Well specifically speaking on this example. In order to install chrome extension like this pop-up, it will redirect to chrome extension gallery page. So if the pop-up is doing something other than that, it should trigger a WTF meter in your head. To install a chrome extension you have manually install it by clicking "ok", even after that if it accesses your private browsing data (which is the only thing Chrome extension has access to) you will get a second warning, making sure you understand this. Even after that, Chrome extension runs on its own process, seperate from each tabs (which runs in its own process). And each of those process runs on its own sandbox. Lets even leave all that out of consideration, and that javascript is being used by some very popular websites, includeing huffpo, independent and some random sites I encountered but don't remember right now. The guy from DS is just crying fowl.
stwe 16y ago
The problem is that the browser owned control bar is right next to the web content. It's good for usability (quick to reach with mouse), but opens the door for trickeries like click jacking (that's actually why there's a countdown when you want to install an extension in firefox). I filed a related bug a year ago at Mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=497388 https://bugzilla.mozilla.org/show_bug.cgi?id=497388 but it didn't get anyone busy (no offense). We probably have to wait until browser extensions are more common place and these kind of UI vulnerabilities get exploited on a regular basis.
- kgermino 16y ago
  This may be a stupid question but, how does the countdown prevent click jacking and the like? Thanks in advance for any answer.

by rg3 16y ago

pavs 16y ago

Well specifically speaking on this example. In order to install chrome extension like this pop-up, it will redirect to chrome extension gallery page. So if the pop-up is doing something other than that, it should trigger a WTF meter in your head. To install a chrome extension you have manually install it by clicking "ok", even after that if it accesses your private browsing data (which is the only thing Chrome extension has access to) you will get a second warning, making sure you understand this. Even after that, Chrome extension runs on its own process, seperate from each tabs (which runs in its own process). And each of those process runs on its own sandbox. Lets even leave all that out of consideration, and that javascript is being used by some very popular websites, includeing huffpo, independent and some random sites I encountered but don't remember right now. The guy from DS is just crying fowl.

stwe 16y ago

The problem is that the browser owned control bar is right next to the web content. It's good for usability (quick to reach with mouse), but opens the door for trickeries like click jacking (that's actually why there's a countdown when you want to install an extension in firefox). I filed a related bug a year ago at Mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=497388 https://bugzilla.mozilla.org/show_bug.cgi?id=497388 but it didn't get anyone busy (no offense). We probably have to wait until browser extensions are more common place and these kind of UI vulnerabilities get exploited on a regular basis.

kgermino 16y ago
This may be a stupid question but, how does the countdown prevent click jacking and the like? Thanks in advance for any answer.