13 ms·

Here’s the thing. It is not our problem that google doesn't want to make alerts less confusing. They are planning to drop support for alert, confirm and prompt

Here’s the thing. It is not our problem that google doesn't want to make alerts less confusing. They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. How are they a security problem?

encryptluks2 5y ago
This is about CSRF. Ever heard the phrase blinded by hate or blind hatred?
- minitech 5y ago
  How are alert and CSRF related at all?
  - encryptluks2 5y ago
    Because this is specifically in regarding to calling them from an iframe.
jeffchien 5y ago
> They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. Can you cite this? Or is this just wild speculation?
- vasachi 5y ago
  The Register cites this: https://github.com/whatwg/html/issues/6897#issuecomment-885773622 https://github.com/whatwg/html/issues/6897#issuecomment-8857... Also this: https://twitter.com/Rich_Harris/status/1422930436850860033 https://twitter.com/Rich_Harris/status/1422930436850860033
  - jeffchien 5y ago
    Thank you!
- deleted 5y ago
  [deleted]
asddubs 5y ago
not to mention not letting people enable them again in their iframes like other security features (although i guess this is somewhat of a moot point since they plan to get rid of them completely)
lmm 5y ago
They make it very easy for a page to present information to the user in a way that looks like it's coming from their system rather than something under the page's control?
- SahAssar 5y ago
  That's very much a browser interface design problem, not a problem of the feature itself. Having clear, simple ways to do things like alert(), confirm() and prompt() is incredibly valuable for doing simpler/quicker stuff on the web.
  - hulitu 5y ago
    Simple staff like: alert (Do you want to install Pegassus ?); prompt (yes).
    - SahAssar 5y ago
      Do you think that prompting the user on a webpage is what is stopping the webpage from installing a rootkit? Pegasus wasn't even a browser bug, it was installed via text message IIRC.
- CJefferson 5y ago
  Then just make the box look more like part of the webpage. They could even put a nasty warning message in the box, as they completely control it.
- acdha 5y ago
  Consider that both Chrome and Firefox have already changed the UI to do things like make the dialog title indicate that this is content from a web page or, in Firefox's case, add an option to prevent a page from spewing repeated alerts. Why should the answer be to break correctly-functioning applications around the web rather than just continuing that process of making these dialogs distinct from the platform controls? There's no standard requiring that they be implemented as a Windows MessageBox() call. Consider what it'd look like as a polyfill which just slams a <dialog> block with inline styles (position:absolute, etc.) into the page — there's no reason why Chrome couldn't implement something better than that and doing so would avoid breaking 3 decades of currently running code chasing after a very minimal security improvement. I say minimal because while it's possible for an attacker now to use confirm() to install a Windows update, removing that function does not mean they'll give up and stop trying. It means that they will add a fraction of a percent to their existing development time making some JavaScript which pops up a dialog styled to look like the platform defaults for the OS your browser advertises. We know that because attackers already spend considerable amounts of time trying to look like legitimate sites and this is not going to be a prohibitive amount of additional work unless there's a sharp decline in the amount of money at play with ransomware and espionage.

encryptluks2 5y ago

This is about CSRF. Ever heard the phrase blinded by hate or blind hatred?

minitech 5y ago
How are alert and CSRF related at all?
- encryptluks2 5y ago
  Because this is specifically in regarding to calling them from an iframe.

jeffchien 5y ago

> They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. Can you cite this? Or is this just wild speculation?

vasachi 5y ago
The Register cites this: https://github.com/whatwg/html/issues/6897#issuecomment-885773622 https://github.com/whatwg/html/issues/6897#issuecomment-8857... Also this: https://twitter.com/Rich_Harris/status/1422930436850860033 https://twitter.com/Rich_Harris/status/1422930436850860033
- jeffchien 5y ago
  Thank you!
deleted 5y ago
[deleted]

asddubs 5y ago

not to mention not letting people enable them again in their iframes like other security features (although i guess this is somewhat of a moot point since they plan to get rid of them completely)

lmm 5y ago

They make it very easy for a page to present information to the user in a way that looks like it's coming from their system rather than something under the page's control?

SahAssar 5y ago
That's very much a browser interface design problem, not a problem of the feature itself. Having clear, simple ways to do things like alert(), confirm() and prompt() is incredibly valuable for doing simpler/quicker stuff on the web.
- hulitu 5y ago
  Simple staff like: alert (Do you want to install Pegassus ?); prompt (yes).
  - SahAssar 5y ago
    Do you think that prompting the user on a webpage is what is stopping the webpage from installing a rootkit? Pegasus wasn't even a browser bug, it was installed via text message IIRC.
CJefferson 5y ago
Then just make the box look more like part of the webpage. They could even put a nasty warning message in the box, as they completely control it.
acdha 5y ago
Consider that both Chrome and Firefox have already changed the UI to do things like make the dialog title indicate that this is content from a web page or, in Firefox's case, add an option to prevent a page from spewing repeated alerts. Why should the answer be to break correctly-functioning applications around the web rather than just continuing that process of making these dialogs distinct from the platform controls? There's no standard requiring that they be implemented as a Windows MessageBox() call. Consider what it'd look like as a polyfill which just slams a <dialog> block with inline styles (position:absolute, etc.) into the page — there's no reason why Chrome couldn't implement something better than that and doing so would avoid breaking 3 decades of currently running code chasing after a very minimal security improvement. I say minimal because while it's possible for an attacker now to use confirm() to install a Windows update, removing that function does not mean they'll give up and stop trying. It means that they will add a fraction of a percent to their existing development time making some JavaScript which pops up a dialog styled to look like the platform defaults for the OS your browser advertises. We know that because attackers already spend considerable amounts of time trying to look like legitimate sites and this is not going to be a prohibitive amount of additional work unless there's a sharp decline in the amount of money at play with ransomware and espionage.