6 ms·

It's a fun trick, but to reassure anyone who's panicking right now, it's not actually moving your cursor It's hiding your cursor while it's over the site, rend

It's a fun trick, but to reassure anyone who's panicking right now, it's not actually moving your cursor It's hiding your cursor while it's over the site, rendering an <img> of a mouse cursor at its location, and then moving that around a) when you move your real cursor, and b) with random perturbations Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white)

vladvasiliu 6y ago
> Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white) I've already seen sites that change the cursor's appearance, so I wasn't particularly "shocked" by that (I'm on a Mac). However, what should improve the illusion would be to not move the cursor outside of the view area.
- tyingq 6y ago
  Pointer lock does that, though I'm not sure what all browsers support it. Chrome/Desktop does: https://mdn.github.io/dom-examples/pointer-lock/ https://mdn.github.io/dom-examples/pointer-lock/ It's a bit odd to me that it doesn't ask for any kind of permission on Chrome, just that a user click initiates it. It does briefly pop a hint that "<esc>" will release the mouse.
- baobabKoodaa 6y ago
  Thanks for the feedback! The behavior around the edges should be improved now.
baobabKoodaa 6y ago
> Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white) You're right, it would make the illusion better. I developed this on Ubuntu where the default cursor is black, and I did consider doing this. Eventually decided to just use the default white cursor from Windows because it has better contrast on the dark color scheme. I guess I could set up 3 different color schemes for 3 different cursors for Mac, Linux, Windows, but it may be a bit too much work. I think most people who notice the cursor is different will just think "oh, this website uses a custom cursor", they won't necessarily realize that it's just an image.
- modeless 6y ago
  Even better would be to use the fullscreen api and mouse capture api to trap the mouse for real. Then you could render fake browser UI and do whatever you want when people try to click on it. If you really wanted to mess with people.
  - baobabKoodaa 6y ago
    If you use the fullscreen api or the pointer lock api, Chrome will render a popup that says "press ESC to..." Without that it would be sick!
    - modeless 6y ago
      Yeah but I bet at least half of people wouldn't notice, especially if you put something interesting on the other side of the screen for a second. Or you could render a bunch of overlapping fake warnings all over the screen, making it difficult to find the real one. Or you could put an exit fullscreen button and pretend to exit fullscreen when clicked, but you're actually still in fullscreen. Etc. I should probably stop giving the malware guys ideas...
      - juotlrjrb 6y ago
        Ctrl+W... Alt+F4...
- Waterluvian 6y ago
  I'm on 18.04 and my cursor is white (and much smaller than the one on the site). I never realised Ubuntu had a black cursor option. I think you could make these changes, but I think that's if you want to have fun doing it. The diminishing returns are tiny and the gag lands well.
  - brundolf 6y ago
    You're probably on a different desktop environment (Gnome, KDE, etc)
throwaway_porn 6y ago
But you should still panic a little bit because this technique can be used for https://en.wikipedia.org/wiki/Clickjacking https://en.wikipedia.org/wiki/Clickjacking
- brundolf 6y ago
  The most it could do is fool you into thinking your cursor is somewhere else within the same web page, which the malicious dev in this case would already have total control over. If they wanted to fool you into clicking something, they'd have an easier time just mis-labeling the button
  - lazaroclapp 6y ago
    Since this can make you think your cursor is in a different position in the page than it actually is, couldn't it potentially be used to mislead you to click outside the page as well? Possibly not into browser chrome[1], but what about on a iframe? Place button A the user wants to interact with at position (X,Y), place iframe button B at position (X+W,Y), with as little a border as possible with the rest of the page, then offset fake cursor by -W. User will try to mouse over button A, mistakenly mouse over button B, and click it in the time it takes to register that the mouse pointer just jumped from the edge of one button to the edge of the other... [1] Though I can see the trick below maybe working for some browser's permission request "tooltip" UIs...
noobermin 6y ago
I mean it was obvious by looking at the inspector if you have firefox. It's funny, I was able to "click" the how does it work button even though it makes it look like you can't mouseover it. Also, kind of obvious given I use a gtk+3 dark theme and the mouse they use is white.
- brundolf 6y ago
  Not everyone here is a web dev who's familiar with the inspector :) With the genuine browser security concerns that do exist out there (and the often-exaggerated narrative around the degree of the problem), it's worth being explicit that this is not actually a real one
minikites 6y ago
I used Mac OS for decades before switching, but I changed my Windows cursor to black because I'm used to it and I genuinely think it makes more sense with most backgrounds being light colors.
Blikkentrekker 6y ago
I'm not sure what the panicking would be about being able to move the cursor inside the website. I had assumed there would simply be Javascript calls for this. — how is it a problem that this be possible? that it can make one click on links that can be activated with Javascript on their own already? Of course it could move one's cursor outside of it's own rendered page that would be problematic, but this trick cannot simulate that either.
- baobabKoodaa 6y ago
  There are no web apis to move a cursor within a web page. That means if you see a website moving your cursor, you see a website doing something it's not supposed to be able to do, and there's no reason to assume that that ability would be limited to the browser window or merely one tab in the browser. (Of course this website does not move your cursor.)
  - Blikkentrekker 6y ago
    It's extremely easy to check because the effect stops outside of the website window itself or when the tab be switched? And even if there is no a.p.i., when a website does it via some creative hack then one can assume the hack is most likely to work inside it's own window only. And finally, how would the average layman no there is no such a.p.i.? even the expert could not be sure it wasn't added yesterday. I really cannot see why the first response would be to panic and think the website somehow found a way to tell the web browser to make X11 calls to move the cursor, which is quite unlikely; the first response would be that there is an a.p.i. to move the cursor inside of it's own window, which is harmless, and after that that there is a creative hack to simulate it, and again, it's very easy to verify whether the cursor can be moved by the website once it leaves the browser window, and it cannot.
    - baobabKoodaa 6y ago
      From what I can gather, April 1st is not your favorite day of the year.
xdrosenheim 6y ago
And the fact that it draws a mouse on mobile-devices.

vladvasiliu 6y ago

> Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white) I've already seen sites that change the cursor's appearance, so I wasn't particularly "shocked" by that (I'm on a Mac). However, what should improve the illusion would be to not move the cursor outside of the view area.

tyingq 6y ago
Pointer lock does that, though I'm not sure what all browsers support it. Chrome/Desktop does: https://mdn.github.io/dom-examples/pointer-lock/ https://mdn.github.io/dom-examples/pointer-lock/ It's a bit odd to me that it doesn't ask for any kind of permission on Chrome, just that a user click initiates it. It does briefly pop a hint that "<esc>" will release the mouse.
baobabKoodaa 6y ago
Thanks for the feedback! The behavior around the edges should be improved now.

baobabKoodaa 6y ago

> Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white) You're right, it would make the illusion better. I developed this on Ubuntu where the default cursor is black, and I did consider doing this. Eventually decided to just use the default white cursor from Windows because it has better contrast on the dark color scheme. I guess I could set up 3 different color schemes for 3 different cursors for Mac, Linux, Windows, but it may be a bit too much work. I think most people who notice the cursor is different will just think "oh, this website uses a custom cursor", they won't necessarily realize that it's just an image.

modeless 6y ago
Even better would be to use the fullscreen api and mouse capture api to trap the mouse for real. Then you could render fake browser UI and do whatever you want when people try to click on it. If you really wanted to mess with people.
- baobabKoodaa 6y ago
  If you use the fullscreen api or the pointer lock api, Chrome will render a popup that says "press ESC to..." Without that it would be sick!
  - modeless 6y ago
    Yeah but I bet at least half of people wouldn't notice, especially if you put something interesting on the other side of the screen for a second. Or you could render a bunch of overlapping fake warnings all over the screen, making it difficult to find the real one. Or you could put an exit fullscreen button and pretend to exit fullscreen when clicked, but you're actually still in fullscreen. Etc. I should probably stop giving the malware guys ideas...
    - juotlrjrb 6y ago
      Ctrl+W... Alt+F4...
Waterluvian 6y ago
I'm on 18.04 and my cursor is white (and much smaller than the one on the site). I never realised Ubuntu had a black cursor option. I think you could make these changes, but I think that's if you want to have fun doing it. The diminishing returns are tiny and the gag lands well.
- brundolf 6y ago
  You're probably on a different desktop environment (Gnome, KDE, etc)

throwaway_porn 6y ago

But you should still panic a little bit because this technique can be used for https://en.wikipedia.org/wiki/Clickjacking https://en.wikipedia.org/wiki/Clickjacking

brundolf 6y ago
The most it could do is fool you into thinking your cursor is somewhere else within the same web page, which the malicious dev in this case would already have total control over. If they wanted to fool you into clicking something, they'd have an easier time just mis-labeling the button
- lazaroclapp 6y ago
  Since this can make you think your cursor is in a different position in the page than it actually is, couldn't it potentially be used to mislead you to click outside the page as well? Possibly not into browser chrome[1], but what about on a iframe? Place button A the user wants to interact with at position (X,Y), place iframe button B at position (X+W,Y), with as little a border as possible with the rest of the page, then offset fake cursor by -W. User will try to mouse over button A, mistakenly mouse over button B, and click it in the time it takes to register that the mouse pointer just jumped from the edge of one button to the edge of the other... [1] Though I can see the trick below maybe working for some browser's permission request "tooltip" UIs...

noobermin 6y ago

I mean it was obvious by looking at the inspector if you have firefox. It's funny, I was able to "click" the how does it work button even though it makes it look like you can't mouseover it. Also, kind of obvious given I use a gtk+3 dark theme and the mouse they use is white.

brundolf 6y ago
Not everyone here is a web dev who's familiar with the inspector :) With the genuine browser security concerns that do exist out there (and the often-exaggerated narrative around the degree of the problem), it's worth being explicit that this is not actually a real one

minikites 6y ago

I used Mac OS for decades before switching, but I changed my Windows cursor to black because I'm used to it and I genuinely think it makes more sense with most backgrounds being light colors.

Blikkentrekker 6y ago

I'm not sure what the panicking would be about being able to move the cursor inside the website. I had assumed there would simply be Javascript calls for this. — how is it a problem that this be possible? that it can make one click on links that can be activated with Javascript on their own already? Of course it could move one's cursor outside of it's own rendered page that would be problematic, but this trick cannot simulate that either.

baobabKoodaa 6y ago
There are no web apis to move a cursor within a web page. That means if you see a website moving your cursor, you see a website doing something it's not supposed to be able to do, and there's no reason to assume that that ability would be limited to the browser window or merely one tab in the browser. (Of course this website does not move your cursor.)
- Blikkentrekker 6y ago
  It's extremely easy to check because the effect stops outside of the website window itself or when the tab be switched? And even if there is no a.p.i., when a website does it via some creative hack then one can assume the hack is most likely to work inside it's own window only. And finally, how would the average layman no there is no such a.p.i.? even the expert could not be sure it wasn't added yesterday. I really cannot see why the first response would be to panic and think the website somehow found a way to tell the web browser to make X11 calls to move the cursor, which is quite unlikely; the first response would be that there is an a.p.i. to move the cursor inside of it's own window, which is harmless, and after that that there is a creative hack to simulate it, and again, it's very easy to verify whether the cursor can be moved by the website once it leaves the browser window, and it cannot.
  - baobabKoodaa 6y ago
    From what I can gather, April 1st is not your favorite day of the year.

xdrosenheim 6y ago

And the fact that it draws a mouse on mobile-devices.