3 ms·
Basically browsers have the "I open a popup to ask" or "the user has no schema handler for that schema so I don't need to ask" or the "User already confirmed it
by dathinab 6y ago
Basically browsers have the "I open a popup to ask" or "the user has no schema handler for that schema so I don't need to ask" or the "User already confirmed it always should open the link with given application" behaviour and they can detect it "somehow "?
But I still have to look closer into it.
- valve1 6y agoBrowsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.
- jszymborski 6y agoIt looks like a mitigation might be that in the event you do not have the application installed, to return a "denied" status and send a prompt to the user like "Unknown application protocol". Something like that could still would be susceptible to a timing attack though.
- Haemm0r 6y agoalways show the popup, but populate it "later" could work too.
- dathinab 6y agoYes I believe the proper fix would be to always behave as if a popup is showing, independent of weather or not it actually shows. Through it's maybe slightly more complex as you might need to behave as if the user clicked cancel in a way where a attacker can not easily differentiate it from an actual user clicking cancel.