5 ms·

What prevents a non-fullscreen site from just faking a keyboard with `position: fixed; bottom: 0;`? Really weird stance they're taking here. Kind of excludes an

What prevents a non-fullscreen site from just faking a keyboard with `position: fixed; bottom: 0;`? Really weird stance they're taking here. Kind of excludes an entire class of web applications (full screen games) from being usable on iPad, almost as if the real motivation is to drive you to the app store...

__s 5y ago
What prevents them is that it'd be within the confines of a website, so url bar tells you you're on a website & not the appstore asking for permission This gets into sandboxes needing to have "sacred pixels" as a border to prevent the sandbox tricking the user into thinking they exited from the browser This issues goes way back: imagine if after executing a program on CLI instead of closing it gave you a fake shell, where you eventually went about your day until you had to type your password into sudo.. Of course, your point about the app store is good motivation to address this, whereas consoles don't go about offering much protection there
- akersten 5y ago
  > , so url bar tells you you're on a website Is this even the case anymore? On Android, all my URL bars peel up into the top of the screen as I browse, and I'm pretty sure a website can capture the vertical swipe/arrange an inner-scrolling element to make it very difficult to quickly get the URL bar visible again. I think that would be enough to trick most users. This seems like an unnecessary limitation
  - saurik 5y ago
    This is iOS, though, where the URL bar is always at least minimally present.
    - t0mas88 5y ago
      On safari, but not on for example Edge for iOS or Chrome for iOS.
      - ogre_codes 5y ago
        Is this security feature present on Edge or Chrome on iOS?
      - jereees 5y ago
        Huh. I’m surprised apple didn’t make it a requirement before approving those apps into their store given how strong their stance on privacy is.
- rsa25519 5y ago
  > This issues goes way back: imagine if after executing a program on CLI instead of closing it gave you a fake shell, where you eventually went about your day until you had to type your password into sudo.. As a fun fact, even worse might be a program maliciously aliasing sudo in ~/.profile
  - spicybright 5y ago
    That's a spooky one, although I've never heard of that happening in practice before. But then again how, how someone know if that happened!
    - moistbar 5y ago
      They'd have to know to look for it, but running `alias sudo` would show if it had an alias assigned to it. It would honestly be more effective to change $PATH to include the malicious version of sudo.
- toxik 5y ago
  Which is a good reminder that password entry is terrible security wise. With macOS, you can sudo authenticate with your Apple Watch, which is really nice.
  - majewsky 5y ago
    If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script. For background, there is a convenience feature in sudo: It only requires your password prompt if you have not had a successful sudo invocation in the same terminal in the last X minutes (5 minutes, I think? not sure on the exact value). "sudo -v" is a special invocation which does not actually execute any command, but it renews your 5-minute lease. ("sudo true" is effectively equivalent, though not idiomatic.) So if you're executing a short script that needs sudo, run "sudo -v" before running the actual script. Then you know that if a root password prompt pops up again, it's not really sudo who's asking.
    - gruez 5y ago
      > If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script. The bigger problem is that even without sudo or your root password, malicious scripts can do a lot of damage. ie. they can add a fake sudo to your .profile, so you next time you try to do "sudo -v" your password still gets stolen.
  - jereees 5y ago
    Is this a feature built in into the OS? I have only heard of some third party code to allow that…
    - toxik 5y ago
      It's not built-in for sudo, which is surprising. It is however for many other authentication prompts.
jtth 5y ago
URL bar at the top, UI chrome is different in full screen vs windowed. (Full screen media playback on iOS has OS-level controls at the top.)
klyrs 5y ago
On my phone, I use an obscure keyboard with a custom theme -- good luck faking that. Doesn't help your average user, though.
- jereees 5y ago
  Fair enough. An attacker wouldn’t need to fake your keyboard though, it’s probably just enough to trick you into thinking you are entering sensitive information into a legit website while in reality it’s made to look that way but still using normal text inputs.
realusername 5y ago
> almost as if the real motivation is to drive you to the app store... Every "security" feature on Safari points into harming web apps so you are on the right tracks...

__s 5y ago

What prevents them is that it'd be within the confines of a website, so url bar tells you you're on a website & not the appstore asking for permission This gets into sandboxes needing to have "sacred pixels" as a border to prevent the sandbox tricking the user into thinking they exited from the browser This issues goes way back: imagine if after executing a program on CLI instead of closing it gave you a fake shell, where you eventually went about your day until you had to type your password into sudo.. Of course, your point about the app store is good motivation to address this, whereas consoles don't go about offering much protection there

akersten 5y ago
> , so url bar tells you you're on a website Is this even the case anymore? On Android, all my URL bars peel up into the top of the screen as I browse, and I'm pretty sure a website can capture the vertical swipe/arrange an inner-scrolling element to make it very difficult to quickly get the URL bar visible again. I think that would be enough to trick most users. This seems like an unnecessary limitation
- saurik 5y ago
  This is iOS, though, where the URL bar is always at least minimally present.
  - t0mas88 5y ago
    On safari, but not on for example Edge for iOS or Chrome for iOS.
    - ogre_codes 5y ago
      Is this security feature present on Edge or Chrome on iOS?
    - jereees 5y ago
      Huh. I’m surprised apple didn’t make it a requirement before approving those apps into their store given how strong their stance on privacy is.
rsa25519 5y ago
> This issues goes way back: imagine if after executing a program on CLI instead of closing it gave you a fake shell, where you eventually went about your day until you had to type your password into sudo.. As a fun fact, even worse might be a program maliciously aliasing sudo in ~/.profile
- spicybright 5y ago
  That's a spooky one, although I've never heard of that happening in practice before. But then again how, how someone know if that happened!
  - moistbar 5y ago
    They'd have to know to look for it, but running `alias sudo` would show if it had an alias assigned to it. It would honestly be more effective to change $PATH to include the malicious version of sudo.
toxik 5y ago
Which is a good reminder that password entry is terrible security wise. With macOS, you can sudo authenticate with your Apple Watch, which is really nice.
- majewsky 5y ago
  If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script. For background, there is a convenience feature in sudo: It only requires your password prompt if you have not had a successful sudo invocation in the same terminal in the last X minutes (5 minutes, I think? not sure on the exact value). "sudo -v" is a special invocation which does not actually execute any command, but it renews your 5-minute lease. ("sudo true" is effectively equivalent, though not idiomatic.) So if you're executing a short script that needs sudo, run "sudo -v" before running the actual script. Then you know that if a root password prompt pops up again, it's not really sudo who's asking.
  - gruez 5y ago
    > If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script. The bigger problem is that even without sudo or your root password, malicious scripts can do a lot of damage. ie. they can add a fake sudo to your .profile, so you next time you try to do "sudo -v" your password still gets stolen.
- jereees 5y ago
  Is this a feature built in into the OS? I have only heard of some third party code to allow that…
  - toxik 5y ago
    It's not built-in for sudo, which is surprising. It is however for many other authentication prompts.

jtth 5y ago

URL bar at the top, UI chrome is different in full screen vs windowed. (Full screen media playback on iOS has OS-level controls at the top.)

klyrs 5y ago

On my phone, I use an obscure keyboard with a custom theme -- good luck faking that. Doesn't help your average user, though.

jereees 5y ago
Fair enough. An attacker wouldn’t need to fake your keyboard though, it’s probably just enough to trick you into thinking you are entering sensitive information into a legit website while in reality it’s made to look that way but still using normal text inputs.

realusername 5y ago

> almost as if the real motivation is to drive you to the app store... Every "security" feature on Safari points into harming web apps so you are on the right tracks...