4 ms·

That won't work if someone it trying to use the code on their desktop. The screen reader won't be able to read the code to them, so they won't be able to log in

by ihuman 7y ago

That won't work if someone it trying to use the code on their desktop. The screen reader won't be able to read the code to them, so they won't be able to log in.

derefr 7y ago
You can autofill the field into a text editor, and read it from there. The security comes from the fact that you had to interact with a privileged UI element to do so, which an accessibility assistant cannot trigger; you need to use the system accessibility features (e.g. the voice assistant) to trigger privileged UI elements. (See also: accessibility of elevation prompts in Windows.)
zepto 7y ago
Thee is no reason not to have a special privilege level for screen readers.
- akerl_ 7y ago
  There is a special privilege level for screen readers. The issue is that the hypothetical malicious app pretends to be a screen reader.
  - zepto 7y ago
    Do you mean it hypothetically actually functions as a screen reader but also steals data, or something that just requests the privilege while being something completely different?
    - akerl_ 7y ago
      Either one, but realistically the latter. In the former case, you just call your app SuperLegitScreenReader, prompt the user to grant accessibility access, and then snarf up data. Bonus points if you bundle in some open source or pirated screen reader code so your app can act the part, but you could probably just say “fetching reader data, screen reading will be functional in ~60 minutes” and count on most users to not bother uninstalling the app or revoking permissions. In the latter case, you call your app “CandyNinjaBirds”, and have it pop up and say “to let you share cute stickers to your friends, you need to enable accessibility access” and count on the vast majority of people to click “allow”. The latter case is way more common because the former case limits your target audience to people who actually want a screen reader.
      - zepto 7y ago
        Ok - but given the small number of actual screen readers it would be easy for a store to have extra policing for this privilege.

by ihuman 7y ago

That won't work if someone it trying to use the code on their desktop. The screen reader won't be able to read the code to them, so they won't be able to log in.

derefr 7y ago

You can autofill the field into a text editor, and read it from there. The security comes from the fact that you had to interact with a privileged UI element to do so, which an accessibility assistant cannot trigger; you need to use the system accessibility features (e.g. the voice assistant) to trigger privileged UI elements. (See also: accessibility of elevation prompts in Windows.)

zepto 7y ago

Thee is no reason not to have a special privilege level for screen readers.

akerl_ 7y ago
There is a special privilege level for screen readers. The issue is that the hypothetical malicious app pretends to be a screen reader.
- zepto 7y ago
  Do you mean it hypothetically actually functions as a screen reader but also steals data, or something that just requests the privilege while being something completely different?
  - akerl_ 7y ago
    Either one, but realistically the latter. In the former case, you just call your app SuperLegitScreenReader, prompt the user to grant accessibility access, and then snarf up data. Bonus points if you bundle in some open source or pirated screen reader code so your app can act the part, but you could probably just say “fetching reader data, screen reading will be functional in ~60 minutes” and count on most users to not bother uninstalling the app or revoking permissions. In the latter case, you call your app “CandyNinjaBirds”, and have it pop up and say “to let you share cute stickers to your friends, you need to enable accessibility access” and count on the vast majority of people to click “allow”. The latter case is way more common because the former case limits your target audience to people who actually want a screen reader.
    - zepto 7y ago
      Ok - but given the small number of actual screen readers it would be easy for a store to have extra policing for this privilege.