5 ms·

With a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, repl

With a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns... The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action. [0]: https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/

jamesfisher 8y ago
Thanks for pointing me to this post - an amazing reference. I'm going to include it in my post.
- cjsawyer 8y ago
  It is fascinating how little we can trust in software that shows content from other users.
degenerate 8y ago
Fun fact, subway systems have been using this concept for decades. Joking aside, "line of death" is easily understood but I never heard the name before. Now that it has a (perfect) name I will never forget it, and that's the importance of giving technology a fitting name. My biggest pet peeve in modern UI is the hamburger menu icon. Three horizontal lines does not, in any way, indicate to the user that menu options lay behind it... and the name was downright awful. We replaced a perfect icon at the time, the "gear" (a gear references an engine, so users looking to change settings understood the analogy). But the hamburger menu tried to remove the "settings" idea and instead encompass navigation, settings, preferences, and operations into one menu icon. In my opinion, it failed, but now is so ubiquitous most people are fine with it.
- Izkata 8y ago
  The hamburger is actually a simplification of the original icon, which actually looked like a pop-up menu, and I think is why it was acceptable for most people during the transition period. Nowadays it probably really is just as you say.
imglorp 8y ago
Oh and do that scammy double-redirect to yourself so back button doesn't work.
Natanael_L 8y ago
I noticed in Firefox Mobile that it refuses to hide the real address bar when it encounters this website behavior.
geuszb 8y ago
Thanks. This is a great reference indeed! The challenge is preserving ability for content to control all pixels; without it, the content ecosystem ends up developing single-purpose, generally crappy apps, which isn't necessarily a better thing either... I'm not sure it is the only solution either - what about "secure attention key" type ways to get the system's attention (in this case the browser's), bypassing any content interception? For example, what if there was a key combo guaranteed to always bring in the browser UI, and typing that key combo was necessary before inputting any password field? Alternatively, the reliance on browser password management could provide some security if it can be trusted to always work...
- akersten 8y ago
  Those are some good ideas too - "only solution" was a bit hyperbolic - but I do think our options are limited, especially on mobile. The Secure Attention Key is interesting, but would need the user to know you press it. And on mobile, it would probably need to be a dedicated button on the device, since I could just fake the on screen keyboard too. Password manager auto-fill failing would clue a savvy user that something was wrong, but I suspect many would just assume it's a glitch and manually enter their credentials. I saw an reply in another thread suggesting customizable browser background images for the UI bar, which a website would have no way of replicating. In my opinion that's probably the best approach, although it might mean throwing away the ability for sites to set the background color of the UI to match their theme (arguably losing nothing of value :).
  - yencabulator 8y ago
    Edge swipe from the top could be made impossible to hijack.
  - Natanael_L 8y ago
    With the use of gesture controls and swipe-up menus and "soft keys", etc, why not put in something like the "pie control" apps on Android, where the OS controls one part and the app controls another? Consider a semi-configurable universal menu with a well defined access method, where you always can back out of the app, and in the case of browsers also have guaranteed access to switching tabs and accessing options, etc.

jamesfisher 8y ago

Thanks for pointing me to this post - an amazing reference. I'm going to include it in my post.

cjsawyer 8y ago
It is fascinating how little we can trust in software that shows content from other users.

degenerate 8y ago

Fun fact, subway systems have been using this concept for decades. Joking aside, "line of death" is easily understood but I never heard the name before. Now that it has a (perfect) name I will never forget it, and that's the importance of giving technology a fitting name. My biggest pet peeve in modern UI is the hamburger menu icon. Three horizontal lines does not, in any way, indicate to the user that menu options lay behind it... and the name was downright awful. We replaced a perfect icon at the time, the "gear" (a gear references an engine, so users looking to change settings understood the analogy). But the hamburger menu tried to remove the "settings" idea and instead encompass navigation, settings, preferences, and operations into one menu icon. In my opinion, it failed, but now is so ubiquitous most people are fine with it.

Izkata 8y ago
The hamburger is actually a simplification of the original icon, which actually looked like a pop-up menu, and I think is why it was acceptable for most people during the transition period. Nowadays it probably really is just as you say.

imglorp 8y ago

Oh and do that scammy double-redirect to yourself so back button doesn't work.

Natanael_L 8y ago

I noticed in Firefox Mobile that it refuses to hide the real address bar when it encounters this website behavior.

geuszb 8y ago

Thanks. This is a great reference indeed! The challenge is preserving ability for content to control all pixels; without it, the content ecosystem ends up developing single-purpose, generally crappy apps, which isn't necessarily a better thing either... I'm not sure it is the only solution either - what about "secure attention key" type ways to get the system's attention (in this case the browser's), bypassing any content interception? For example, what if there was a key combo guaranteed to always bring in the browser UI, and typing that key combo was necessary before inputting any password field? Alternatively, the reliance on browser password management could provide some security if it can be trusted to always work...

akersten 8y ago
Those are some good ideas too - "only solution" was a bit hyperbolic - but I do think our options are limited, especially on mobile. The Secure Attention Key is interesting, but would need the user to know you press it. And on mobile, it would probably need to be a dedicated button on the device, since I could just fake the on screen keyboard too. Password manager auto-fill failing would clue a savvy user that something was wrong, but I suspect many would just assume it's a glitch and manually enter their credentials. I saw an reply in another thread suggesting customizable browser background images for the UI bar, which a website would have no way of replicating. In my opinion that's probably the best approach, although it might mean throwing away the ability for sites to set the background color of the UI to match their theme (arguably losing nothing of value :).
- yencabulator 8y ago
  Edge swipe from the top could be made impossible to hijack.
- Natanael_L 8y ago
  With the use of gesture controls and swipe-up menus and "soft keys", etc, why not put in something like the "pie control" apps on Android, where the OS controls one part and the app controls another? Consider a semi-configurable universal menu with a well defined access method, where you always can back out of the app, and in the case of browsers also have guaranteed access to switching tabs and accessing options, etc.