24 ms·
The inception bar: a new phishing method
- hatsix 7y agoEverything looks correct on chrome mobile. I don't ever see the HSBC bar, regardless of how I scroll.
- lysp 7y agoThere was a similar thing reported a few months ago relating to a fake Facebook social login popup. https://myki.com/blog/facebook-login-phishing-campaign/ https://myki.com/blog/facebook-login-phishing-campaign/ It adds the browser elements to make it appear like a verified popup. The only reason it was discovered was due to users complaining that the password manager did not auto-populate the form. https://news.ycombinator.com/item?id=19188386 https://news.ycombinator.com/item?id=19188386
- mrhappyunhappy 7y agoBack in the day you used to be able to get people to click a series of sharing dialogs with fake iframe overlays. People were abusing it to get insanely viral posts shared by millions.
- fredley 7y agoThis is pretty scary. Is there any way a desktop browser can mitigate against this sort of attack?
- todipa 7y agoWow, didn't even think it was possible to do this.
- doctorless 7y agoInteresting. iOS Safari seems to force the address bar to stay visible on this page.
- vegizombie 7y agoFirefox for android keeps the bar there too.
- clusmore 7y agoJust to be clear, you're referring to real Firefox address bar (pointing to TFA), not the fake Chrome address bar (pointing to hsbc.com). So yes, in this case Firefox has (accidentally?) somewhat thwarted this attack vector.
- tty2300 7y agoIt certainly looks accidental. It hides on scroll on other pages but this one causes it to half hide and then it pops back up again.
- grahamburger 7y agoI noticed this as well. I'm wondering if FF is smart enough to always show it's own title bar if a CSS element is pinned to the top of the viewport? Gotta do more testing ...
- jamesfisher 7y agoInteresting! So it does. However Firefox does hide the URL bar on other pages! I'll try to figure out what the logic is in Firefox, and whether there's an equivalent trick to hide the URL bar ...
- giancarlostoro 7y agoThat is a setting you can enable or disable. I think default is to always show title bar.
- 7y ago
- Nextgrid 7y agoRelated: https://feross.org/html5-fullscreen-api-attack/ https://feross.org/html5-fullscreen-api-attack/
- jamesfisher 7y agoCool - this attack is perhaps worse! Fullscreen should require a more explicit permission dialog, like webcam access, web push notifications, etc.
- zzo38computer 7y agoAt least on my computer there is a permission dialog for the fullscreen API. However, if document scripting is disabled (which is what I have by default anyways) then the link does not do those stuff. (I also use an unusual window layout, so if someone tries to spoof the window layout, it is likely that I can easily see the problem immediately anyways.)
- Ayesh 7y agoRelax, he was just joking.
- saagarjha 7y agoFWIW, opening that link in mobile Safari shows a large “X” in the top left of the screen and trying to scroll sets of the “it looks like you’re typing in fullscreeen” warning.
- carroccio 7y agoThere is previous work on the matter: A fake Firefox XUL browser if I recall correctly (UI readdressing). This attack is for sure nice and effective!
- zzo38computer 7y agoNot using Chrome, and not having a padlock in the URL bar, and disabling non-ASCII URLs, fixes many of this problem. Another possibility would be to display a "collapsed" address bar, so that you can see that it is not the actual bar, but rather is another one.
- theclaw 7y agoMobile safari does the collapsed address bar.
- jamesfisher 7y agoIMO, the collapsed address bar is the most pragmatic fix to this issue. (The other fixes are options that users would have to opt in to, rather than being fixed at the source - i.e. Chrome.)
- afarviral 7y agoThe scroll jail didnt work for my firefox for android latest stable.
- tyingq 7y agoThe article indicates it's not supposed to. It's a quick and dirty proof of concept, working in one environment (Android/Chrome), with a screenshotted fake header. Just enough to prove the point.
- kerng 7y agoDoesn't seem to work with Firefox on Android but a nifty little trick for sure!
- nkozyra 7y agoThis sort of works on chrome Android, but the critical overflow:hidden trick does not prevent chrome from restoring the real address bar.
- enedil 7y agoI'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.
- jamesfisher 7y agoIn principle, it's not a mitigation - I was just too lazy to forge an interactive URL bar! You could make one which acts just like the Chrome URL bar, but e.g. acts as a MITM.
- jannotti 7y agoAt first I though you wouldn't be able to stay "in the middle" because you'd have to redirect to the typed address. You can't AJAX it in, because of CORS. But you could go to your own host and have your server sit in the middle. The user wouldn't be logged in, since cookies wouldn't be sent. But maybe they would login through your proxy.
- delfinom 7y agoYou can simulate that though since it's an html element being rendered with css.
- mk89 7y agoUsing Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear. Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...
- deleted 7y ago[deleted]
- antonvs 7y agoUsing Firefox Beta for Android v67.0b9, I see the hbsc address bar as a second address bar below the real one. It remains in place as I scroll, although a couple of times it disappeared. Also this version wouldn't fool me because it says I have 26 tabs open. I'm used to the infinity symbol there!
- mk89 7y agoI am using Firefox 66.0.2. (how could I forget to mention that!).
- Arkanosis 7y agoUsing Firefox 66.0.2 on Android as well. Pretty much the same behavior here, except that it does not look random at all: - at the top of the page, if I scroll, the address bar disappears; - as soon as the fake HSBC bar appears, the real address bar comes back; - both of them remain here until I reload the page. It looks like if the use of CSS position: fixed forced the Firefox address bar to be visible. Which given the context looks like a really good thing!
- codedokode 7y agoIf Firefox doesn't trust elements with position: fixed, one could use position: absolute or even position: static (the default value) instead and move element when scrolling.
- 7y ago
- paul7986 7y agoPoor Android users .. no blue bubbles and now this!
- amingilani 7y agoSecurity vulnerabilities are discovered across all platforms. Just recently did we find an eavesdropping vulnerability in iOS[0] that certainly qualifies as far more severe. Given how security issues can pop up for any platform, I don't think calling one group of users "poor" is prudent, or a nice thing to do. [0]: https://www.forbes.com/sites/daveywinder/2019/01/29/apple-confirms-iphone-facetime-eavesdropping-exploit-heres-what-to-do/#711ba821745b https://www.forbes.com/sites/daveywinder/2019/01/29/apple-co...
- astura 7y agoLooks like the "never redisplay the true url bar" trick didn't work for me on my mobile Chrome. https://imgur.com/a/Pjybovf https://imgur.com/a/Pjybovf
- bellerose 7y agoI guess this risk could be mitigated if the browser had recognition code running in the background for if the top of the screen was mimicking the search bar. I'm not fond of the idea that we put restrictions of fullscreen mode where it requires user approval when scrolling down or something of that sort.
- below43 7y agoDoesn’t scale well to small mobile devices (eg iPhone SE)
- Gaelan 7y ago"Make sure you’ve done a hard refresh of the page" An inception bar could include a fake refresh button, no?
- dgoldstein0 7y agoCould, but chrome mobile doesn't have one at the top level... Guess it could fake the whole menu too
- userbinator 7y agoThis is why I think removing the physical (as in, below the screen --- whether they're capacitive or actual pushbuttons isn't the point here) buttons from Android devices is a horrible idea; a webpage can mess around with what's on the screen, but it can't stop the user pressing the physical menu button and choosing Refresh from there.
- Dylan16807 7y agoSoft buttons can't be covered by a normal web page either, though.
- GordonS 7y agoBy "hard refresh" I took that to mean using the keyboard to forcibly reload the page and all assets, e.g. CTRL-F5 on Windows. Of course, the average user probably doesn't use keyboard commands, or even know this one exists.
- jamesfisher 7y ago
- ikeboy 7y agoI happened to have 26 tabs while loading this, and spent a minute trying to figure out how the fake bar "knew" my open tab count
- lucb1e 7y ago... so how does it? Edit: saw in another comment that it's hardcoded, so it was coincidence. That makes sense.
- puzzle 7y agoIn Chrome beta 74, the count is in the bottom toolbar, so a variant of this attack that were UA-aware might have an even easier time. (The padlock is no longer green, either, and the leading https:// https:// is omitted.) On the other hand, scrolling to the very top of the page reveals the original address bar. A possible mitigation would be to use a custom background or gradient for the bar that a web page can't guess. I'd be tempted to suggest the Google account's picture (if Chrome is logged in), but I don't know how safe that is from cross-site shenanigans.
- userbinator 7y ago"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme), but it seems the trend toward un-customisability is just going to lead to this being even more easy to exploit. Of course, mobile browsers hiding important information and being even more un-customisable makes this worse. Well, even I, as the creator of the inception bar, found myself accidentally using it! When reading a product's documentation that has screenshots explaining how to do something, I've also accidentally tried to manipulate them instead of the actual dialogs. I'm sure others here have had similar experiences too.
- walrus01 7y agoI have an unquantified theory that the number of users that can distinguish between a Windows 7/8/10 dialog box that is presented directly by the operating system, versus as an image inside a browser coming from external http/https server, is diminishing greatly every year.
- sandworm101 7y agoExcept all the colorblind people who have altered their system defaults enough that anything internal to the browser will look very out of place.
- EamonnMR 7y agoI didn't see it working on Chrome on my phone (chrome 73.0.3683.90, OnePlus 6) Edit: does work with a refresh
- robocat 7y agoPerhaps you have JavaScript disabled.
- crushcrashcrush 7y agoThis is why chrome is a terrible choice - it disregards OS UI/UX choices.
- deleted 7y ago[deleted]
- Waterluvian 7y agoI'm not doubting the concerns raised but the fake failed in many ways for me on my phone with the latest chrome. It didn't appear. Then when it did it appeared below the existing bar. But I guess you just need it to work often enough.
- ehnto 7y agoIt's like the fake "Allow Notification" dialogs on some sites. They look off to pretty much anyone paying attention, but their target market probably isn't people paying attention
- jfoster 7y agoWhat's the idea behind those? Do they just get permission before showing the real dialog, or is it more sinister than that?
- Macha 7y agoIf the user says no to the real dialog, you can never bring up the real dialog again. Sites with fake dialogs in my experience ask again the next time you open the page.
- atomwaffel 7y agoIt’s the same reason many iPhone apps implement their own dialogues to ask about allowing notifications. If the user chooses ‘Deny’ in the system-provided one, the app can never ask again and the only way to turn notifications on later is to have the user go digging around in the Settings app, which few people will bother to do. I take great pleasure in choosing ‘Allow’ in those custom dialogues and then ‘Deny’ when the native one pops up immediately afterwards.
- ehnto 7y agoI would leave them alone entirely, as you can see from my comment they are actually sometimes attempts to compromise your browser.
- 29athrowaway 7y agoChange your system font.
- lgats 7y agoslightly related, js [limited] system available font detection: https://gist.github.com/fijiwebdesign/3b0bf8e88ceef7518844 https://gist.github.com/fijiwebdesign/3b0bf8e88ceef7518844
- saagarjha 7y agoSafari has prevented websites from accessing nonstandard fonts as an anti-fingerprinting technique for a while now, so this script does not quite work for those.
- woliveirajr 7y agoWell, people still believe that they will help a prince from Nigeria. Also I've seem some old ladies believing that a younger soldier from US needs help taking money out of %some country%. A fake address bar, with a fake "look, I'm safe" mark on it? Yes, it'll do it.
- skunkworker 7y agoA recent example that I've been seeing more and more is pages taking over some system keyboard shortcuts. I've seen pages taking over Command-F and using their own search interface instead of the browsers. I've found utilities for not messing with copy/paste, but is there a way to block pages with keyboard shortcuts in Chrome?
- GordonS 7y agoHijacking CTRL-F drives me nuts! I really think this should result in a permissions dialog from the browser.
- Ayesh 7y agoThis worked brilliantly on my Chime Android, and I'm quite surprised the scroll-jail trick worked too. I suppose the author just wanted a quick PoC, but with enough work, one could mimic an interactive browser address bar, including the menu that with refresh, bookmark, etc and even the HTTPS padlock with security information. Browser UIs being designed in CSS itself, one could easily copy/paste from the browser itself.
- b34r 7y agoYahoo actually tried to do this in 2015 with an internal initiative called “Silver Search” to try and trick Firefox users into using their own yahoo-powered omnibux. I was fucking livid when I found out about it and complained.
- b34r 7y agoomnibox
- cookingrobot 7y agoFYI this isn’t occurring on chrome or safari on iOS. As soon as the fake bar appears the page stops scrolling normally - the scrolling inertia stops so that I can scroll but not “toss” the page, and the real address bar no longer hides. I wonder if this is a deliberate mitigation, or an accident?
- BoorishBears 7y agoI wonder if this behavior is Google trying to make AMP pages behave a certain way in Chrome... It mirrors the exact behavior of an AMP page's header.
- sjroot 7y agoThis is because iOS browsers use WebKit and leverage the CSS `overflow-scrolling` attribute. https://developer.mozilla.org/en-US/docs/Web/CSS/-webkit-overflow-scrolling https://developer.mozilla.org/en-US/docs/Web/CSS/-webkit-ove...
- GordonS 7y agoAlso doesn't work using Brave on Android. Which is unexpected, since it's now based on Chromium.
- akersten 7y agoWith a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns... The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action. [0]: https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/
- jamesfisher 7y agoThanks for pointing me to this post - an amazing reference. I'm going to include it in my post.
- cjsawyer 7y agoIt is fascinating how little we can trust in software that shows content from other users.
- degenerate 7y agoFun fact, subway systems have been using this concept for decades. Joking aside, "line of death" is easily understood but I never heard the name before. Now that it has a (perfect) name I will never forget it, and that's the importance of giving technology a fitting name. My biggest pet peeve in modern UI is the hamburger menu icon. Three horizontal lines does not, in any way, indicate to the user that menu options lay behind it... and the name was downright awful. We replaced a perfect icon at the time, the "gear" (a gear references an engine, so users looking to change settings understood the analogy). But the hamburger menu tried to remove the "settings" idea and instead encompass navigation, settings, preferences, and operations into one menu icon. In my opinion, it failed, but now is so ubiquitous most people are fine with it.
- Izkata 7y agoThe hamburger is actually a simplification of the original icon, which actually looked like a pop-up menu, and I think is why it was acceptable for most people during the transition period. Nowadays it probably really is just as you say.
- rotexo 7y agoWhenever I’m looking at an iPhone screenshot someone posted on social media on my iPhone, I try to navigate using the buttons in the image. There ought to be a long German word for that experience.
- isoprophlex 7y agoKlickbarernavigationselementeillusion?
- FabHK 7y agoBenutzeroberflächenabbildungsverwechslungsgefahr (user interface image confusion danger)
- Tepix 7y agoThere's a not so long one: Verarschung
- deleted 7y ago[deleted]
- d0bby 7y agoI like how this is a trend now, fake popups, fake url bars. Maybe _unique_ browser designs would help users.
- pochamago 7y agoHuh naked browser doesn't even show the fake address bar
- quietbritishjim 7y agoThe scroll jail is easily defeated by grabbing the fake address bar and pulling that down, rather than pulling down the main content area.
- Simon_says 7y ago> when you visit this site on Chrome for mobile, and scroll a little way, the page is able to display itself as hsbc.com: I would like to test this out, but I'm not willing to install spyware. Can anyone confirm this?
- suzzer99 7y agoI'll worry about this when I stop getting emails from my banks and credit card companies that look like cheesy phishing emails and ask me to click the link then login. My point is that none of this stuff matters if major corporations continue to send out terrible emails that basically encourage consumers to engage in risky behavior.
- asgs 7y agoit was hard to reproduce this behaviour on Firefox mobile, but it did happen twice after multiples of scroll ups and downs. so the question is, is it a common browser bug?
- afandian 7y agoI can't help but think that this was made possible by the complete collapse in common UI standards. 'Apps' have stopped being OS-toolkit apps and moved onto the web, and of course each designer needs to have their own special on-brand widget style. This has leaked onto the few remaining desktop apps: Chrome rejects the standard Mac OS widgets and reimplements everything, from buttons to the print dialog. Spotify does its own thing. And lest we think Apple has much respect for UX, iTunes is a mess. I genuinely can't use it. The result is that users have been trained not to expect consistent UI paradigms. Every UI is hunt-and-peck. And that paves the way for this kind of exploit.
- dan-robertson 7y agoI don’t see what relation this rant has to the op. Surely the issue here is nothing to do with the ui displayed and more to do with the fact that it is possible to fake the browser ui. Even if chrome were using traditional controls on a desktop, one could imagine an exploit where clicking a malicious link puts the browser in full screen mode (most browsers only accept being put in full screen mode from event handlers for user interactions like clicking), and displays a fake browser ui inside. This was anticipated and partly avoided by a reasonably large modal which pops up to tell you you’re in full screen mode, and disappears after a few seconds. Another similar exploit on desktop was to set the cursor of the page to be a very large image which would overlay the browser chrome and put some fake information there. The issue on mobile could perhaps be reduced by having some amount of ui that doesn’t go away (safari does this in portrait mode). Another help could be to not make the ui disappear (or make it reappear) when this kind of scrolling an iframe situation arises
- Izkata 7y agoUm, what? Standardization of UI is what makes this type of thing feasible large-scale, not the collapse of standardization. Even just in this case - making it look like Chrome mobile results in a different bar than Firefox mobile. If they converge more though it'd take less effort to hit more people.
- jimktrains2 7y ago> 'Apps' have stopped being OS-toolkit apps and moved onto the web, and of course each designer needs to have their own special on-brand widget style. Which is also why they are so abombinally large. Picking on Skype, but they are by no means the only or worst, the Android app is 71MB. There is no sane reason it needs to be that large except for all of the custom assets and custom widgets.
- meuk 7y agoLooks like they 'fixed' this in Chrome for mobile. The URL bar no longer disappears on his site (but it does on most other sites).
- a_c 7y agoWhen using firefox focus on android, the whole image is blocked from loading
- logicallee 7y agoI recently helped someone install vlc. I googled VLC download (relying on Google) and then clicked through the clearly labelled download links. I accidentally must have clicked a link twice because two copies started downloading. The more recent one was finished so I literally started opening the executable. The only thing that stopped me was that it was called vlc-streaming or something, and the one next to it was still downloading, slowly. That's because it was a download triggered by vlc's ad partner. It wasn't VLC. This wasn't some shady part of the Internet. I was livid. If they had given it the same name, size, and approximate download speed as the file I was downloading, I would have had zero way to determine this. Everyone has accidentally started two downloads when they just wanted one copy. Unreal that this could happen on an official site. (And that it basically tricked me.)
- quickthrower2 7y agoI’m convinced to use windows store or Choco to install stuff for this reason. Paint.net is practically impossible to download from their as infested site.
- rickdg 7y agoIf I see 26 tabs open, I immediately know something is wrong.
- huffmsa 7y agoIf I scroll up high enough, I get both address bars. Then if I scroll back down both stay in place. The inception bar isn't clickable, ever. On chrome 73.0.3683.90
- deleted 7y ago[deleted]
- z3t4 7y agoI tried to exploit the mobile browser hiding the address bar when scrolling to hide the address bar in a web game/app to get more screen real estate on mobile but most browsers make it very hard.
- cm2187 7y agoBy override the scroll behavior, it also makes the page feel very unnatural on an ipad (I think it’s the inertia effect missing).
- gmueckl 7y agoThe illusion is almost perfect. However, it breaks when you scroll back to the very top. The real address bar reappears on top amd stays there even when scrolling back down. This is with Chrome 73.
- oftenwrong 7y agoA similar attack could be done with fake password manager UI elements.
- astura 7y agoI saw a proof of concept video of exactly this using LastPass.
- Forge36 7y agoYuck. I have a custom UI on mobile so it's out of place to see white. I also just suffered from a bug causing images to half load (no idea why it seems new). In trying to get images to load I got the tab count portion loaded, I then immediately tried changing tabs ... With the fake button I just made show up.
- 3pt14159 7y agoI figured out something kinda like this but worse. I don't really know how to make it public though because it hits so many different pieces of software that I struggle to see how I could give enough warning to all of them. Thousands of entities, really. If someone else has dealt with this please reach out I want to make it public in a safe way.
- stabbles 7y agoThe usability / security trade-off is difficult. Another example where Chrome prefers usability over security is autofill, where a user can accidentally share more personal information than he/she wishes: https://medium.com/@stabbles/why-you-should-disable-autofill-bf2e15c65b5c https://medium.com/@stabbles/why-you-should-disable-autofill...
- colanderman 7y agoI understand why this was a problem in 1995, but honestly, in 2019, with image recognition technology as advanced as it is now – especially due to efforts by Google – why can't browsers detect this? Surely "does this rectangle look vaguely like a URL bar" is an easier problem to solve than "is this a photograph of a cat"? Sure, image recognition is CPU intensive, but even just checking once every 5 seconds or so would be enough to prevent this sort of attack and pop up a big "you are being phished" warning. And 99.99% of what occupies that UI real estate looks sufficiently unlike a search bar that a low-cost recognizer should be able to rule out phishing for normal sites fairly quickly. What am I missing? Has this approach been tried and rejected? Is image recognition of fairly static, flat, 2D, geometric shapes actually far more CPU-intensive than I imagine?
- ctz 7y agoMachine learning-style image recognition tends to work extremely poorly with adversarial inputs.
- mizzao 7y agoWhile this is true, it's usually referring to algorithmically chosen adversarial inputs. On the other hand, it's a lot harder to trick both the browser's image recognition and the human operator's visual senses with the same UI.
- ericpauley 7y agoThis is actually one of the core goals of adversarial machine learning: crafting inputs that trick a machine but look indestinguishable to a human [1]. [1] https://arxiv.org/pdf/1511.07528.pdf https://arxiv.org/pdf/1511.07528.pdf
- snazz 7y agoMobileSafari has an interesting feature that your idea reminded me of: it tries to detect when a site using the Fullscreen API presents an iOS keyboard-lookalike through the location and frequency of your taps on that side of the screen. I’ve gotten the warning when doing something else and was impressed they thought of it.
- chris_engel 7y agoJavascript is disabled by default in my mobile browser shrugs
- oedmarap 7y agoUsing Firefox Focus on Android and the bar doesn't show up at all. Re-enabled Chrome temporarily and the bar does show up, however.
- bartimus 7y agoPerhaps a solution would be to allow the browser to share a "fingerprint" with specific websites. To make a trusted connection. The website would know if a trusted connection exists for the user and deny all login attempts coming from unauthorized fingerprints.
- deleted 7y ago[deleted]
- ldng 7y agoSlightly OT, but it's HTTPS so it must be safe, right ? It's an example of why the "HTTPS everywhere" push annoys me, it gives false sense of security. Security resources should be better spent. Also, back on topic, Google should stop handing blindly the wheel to "Designers". Oversimplification instead of properly educating people lead to this crap.
- DownGoat 7y agoHTTPS everywhere is a good thing. HTTPS was never about protecting against phishing, and has never protected you against phishing. There is no way to educate people about phishing, only way to protect against it is U2F. Education against phishing is not very effective, and only works short term.
- yjftsjthsd-h 7y agoRight, but it was pushed as "lock icon means secure" and end users don't distinguish threat models.
- ldng 7y agoExactly, and I disagree on education. People can and must be taught on security (not just phishing). But that also mean some standardization on the browser UI and not trying to make it "seamless" and "transparent". This exploit is the result of voluntarily blurring the lines between Traditional Apps and Web Apps. Well, the threat model being very different, it's not a good idea. HTTPS is a part of a whole and pushing so hard make people (even tech savvy ones) focus too much on it. How many CTOs are happy with just putting HTTPS on their website so they can check the security checkbox ?
- WorldMaker 7y agoWhich is arguably why the push is increasingly to "Not Secure" and "Is Maybe Secure" notifications over "Is Secure". Maybe that will help more end users.
- dcbadacd 7y ago
- bawana 7y agoReading these comments initially got me sad. How many echoes of the article’s theme - ‘look at this flaw and how I exploited it’. At first I thought the author had cast a magical spell to bring out the dark side in us. But really, The initiative in us that is adversarial already exists and is simply suppressed. We go about all day acting ‘civilized’ while the animal in us paces nervously waiting for an opportunity to get out. And in the anonymity of the net, we let the animal out. How many of us would brag about these accomplishments to our children or to our boss at work? But then I realized how honest every post was. How anonymity also encouraged ‘free’ speech. And remarkably how much data was shared. Before the net, when we couldn’t be anonymous, we couched our meanings in bs and obfuscation. The ‘bs’ meter was a finely tuned process that you had to develop and run in the background to sort the chaff from a person’s words. Now, comments are often accompanied by a github link where I can read and test the code that people brag about. Thank you internet
- pmoleri 7y agoScary exploit! Would it also work using Element.scrollIntoView()? In such case it wouldn't even need user interaction.
- Causality1 7y agoThis scroll jail shit is why I absolutely despise AMP pages.
- codedokode 7y agoThis fake bar reminds me of a fake address bar that Google displays in an AMP viewer and efforts it takes to be able to replace URLs in an address bar instead of just letting the user visit the target site.
- sizzle 7y agoTotally fooled me, but pulling down on the fake 'inception' bar brings back Chrome's url bar. Neat trick.
- odux 7y agoI like how 10 years back or today the answer to such pishing issues (then specifically tragetted to IE, now Chrome) is 'use Firefox'.
- stdcall83 7y agoI written in quick basic clone of novell network login screen and dumped passwords to a file. Got dozens of students passwords and did nothing with it... I was 13 years old...
- rilax 7y agoIt works with the desktop version too if you go full page (F11) I did use chromium to test.
- BentFranklin 7y agoReading this reminded me of the time in the 80s when I discovered hex editors and changed COMMAND.COM to reverse every DOS command. So to get a directory listing you had to type RID, COPY became YPOC, etc. The error message was !sdrawkcaB. I know I'm no hacker but everyone else thought I was.
- IAmAnIssue 7y agoTurns out if you lock the phone the actual address bar reappears after you unlock your phone
- Stugie 7y agoI found a fix to this problem, on accident. I use Blokada apk on android (not the Google play store version, the good one, if that makes a difference) and when first visiting the page didn't see what the hell you were talking about, the inception url bar never showed up for me. So, when most things don't load or don't act as they're supposed to that is the first thing I go and do-- disable Blokada and reload. Once I did, then it showed up, (pretty cool little discovery btw, good job) So tl/dr; Can be fixed by using ad+malware blocking host file, namely this one, https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Hosts/GoodbyeAds.txt https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master... since it's the one I use and was using when I noticed this
- Stugie 7y agoBumping this so it doesnt get lost...