6 ms·

Please do not add logo customization. This will end with prompts asking you for your Apple and Microsoft passwords which are difficult to differentiate from off

Please do not add logo customization. This will end with prompts asking you for your Apple and Microsoft passwords which are difficult to differentiate from official prompts (at least for end users).

cobbzilla 5y ago
What if the icons are NFTs with automated browser verification? I’m only half joking— could this actually be doable?
- Kalium 5y ago
  Verification of what, precisely? That it's authorized for the domain it's on? This seems like a re-implementation of existing access control systems, with the same weakness of being vulnerable to being copied. Unless you're somehow able to get everyone to transition at once, never support a non-NFT fallback and, ensure that no sufficiently visually similar logo ever gets registered... which IMO sounds both challenging and like a hacky re-implementation of a trademark system.
  - cobbzilla 5y ago
    This would be verification that any branding on the HTTP Basic Auth popup represents the company it claims to. This would be optional — any site that didn’t use this would still have the default (generic/unbranded) browser behavior. The stated (and valid) concern is that malicious actors would use fraudulent branding on those browser auth popups — let’s tell the user we are MSFT or AAPL and steal their password. One solution is for the branding to consist entirely of NFT assets that can all be tracked to a definitive owner, and use some DNS-based glue (ala DKIM/SPIF for email) to link the NFT to the TLD. Then your browser can refuse to show the MSFT logo (and show a big red fraud alert page) if the owner of the branding can’t be reliably traced back to Microsoft (owner of the site).
    - Kalium 5y ago
      At this point you're talking about checking a signature. Naively, it seems to me like you could skip the NFT entirely and embed a verifiable sig in a securely delivered DNS record. Then it's linked to the domain. You can do this now, with tooling that already exists and is deployable today. You'd need to deliver the record securely to avoid attacks on the glue anyway. Of course, neither the NFT nor the sig-in-DNS approach actually solves the problem of a visually identical but technically different image (use a slightly different color in a few places, etc.) being used to trick people. I'm not sure what we've gained. The malicious use case would seem like it's not effectively prevented.
      - cobbzilla 5y ago
        You’re right. Both about the problem still being present and NFT being not strictly necessary anyway. I can’t help but think there must be a way to make it work.
        Kalium 5y ago
        There probably is, provided you can get a perceptual model that correctly models all human visual perception and reduce it to a hash. I am not sure one exists currently. Until then, it really does seem like we're trying to find a way to re-implement trademarks in a way that doesn't require the interpretive work that trademarks rely on. I suspect there's a lot of complexity hidden in the perceptual model requirement, though.
Kalium 5y ago
Thank you! This is a deeply underappreciated point. I understand how annoying, painful, and disruptive to the user experience it is to have part of your app taken over by browser or OS default widgets and behavior is. It's sheer hell on UX. Yet the custom styling that would make it integrate smoothly would be a godsend for attackers and phishers. The role that UX - and misuses of UX - play in security is often not considered deeply by highly sophisticated users.
- Aeolun 5y ago
  I’m kind of inclined to think that completely indefferentiated username and password forms are much more of a godsent?
- jamil7 5y ago
  Is this actually hell on UX or is that something product people and designers tell us because it’s in their personal interest to create custom solutions for every webapp? iOS apps pretty regularly defer user actions to OS level controls and prompts and frankly I believe the UX there is far superior to webapps using bespoke UX for these. Wouldn’t standardised browser behaviour and OS level styling for common flows and behaviour be a big win for webapps and take some of the drudgery out of web development?
  - Kalium 5y ago
    Like you, I suspect it's not, but I've found that leading with telling people that the thing they deeply want to believe is wrong is a poor way to convince them of things. You have to go through a ritualistic performance of empathy first.
- maficious 5y ago
  What prevents the hacker from cloning the whole web-page of, say, facebook.com login and phish users for credentials this way? This is not a hyphotetical thing, Kali Linux even bundles a utility program for that. Compared to that, one icon, that is the same as that of the company, is not that threatening. Not only that, but if you consider a sign in form that wouldn't have a logo, it would be way easier to trick user into putting their credentials in, because the user wouldn't be able to differentiate them. Also OAuth is always branded AFAIK. Users may also notice discrepancies in the logo, if it was cloned poorly. Though I can't think of a way someone couldn't forge a logo given all the possibilities. Adobe Illustrator can trace images into svg and there's plenty of companies' svg logos just in the google search.
lordlimecat 5y ago
You can already do this. As always the only defense is to compare what is being asked for with the FQDN.

Please do not add logo customization. This will end with prompts asking you for your Apple and Microsoft passwords which are difficult to differentiate from official prompts (at least for end users).

cobbzilla 5y ago

What if the icons are NFTs with automated browser verification? I’m only half joking— could this actually be doable?

Kalium 5y ago
Verification of what, precisely? That it's authorized for the domain it's on? This seems like a re-implementation of existing access control systems, with the same weakness of being vulnerable to being copied. Unless you're somehow able to get everyone to transition at once, never support a non-NFT fallback and, ensure that no sufficiently visually similar logo ever gets registered... which IMO sounds both challenging and like a hacky re-implementation of a trademark system.
- cobbzilla 5y ago
  This would be verification that any branding on the HTTP Basic Auth popup represents the company it claims to. This would be optional — any site that didn’t use this would still have the default (generic/unbranded) browser behavior. The stated (and valid) concern is that malicious actors would use fraudulent branding on those browser auth popups — let’s tell the user we are MSFT or AAPL and steal their password. One solution is for the branding to consist entirely of NFT assets that can all be tracked to a definitive owner, and use some DNS-based glue (ala DKIM/SPIF for email) to link the NFT to the TLD. Then your browser can refuse to show the MSFT logo (and show a big red fraud alert page) if the owner of the branding can’t be reliably traced back to Microsoft (owner of the site).
  - Kalium 5y ago
    At this point you're talking about checking a signature. Naively, it seems to me like you could skip the NFT entirely and embed a verifiable sig in a securely delivered DNS record. Then it's linked to the domain. You can do this now, with tooling that already exists and is deployable today. You'd need to deliver the record securely to avoid attacks on the glue anyway. Of course, neither the NFT nor the sig-in-DNS approach actually solves the problem of a visually identical but technically different image (use a slightly different color in a few places, etc.) being used to trick people. I'm not sure what we've gained. The malicious use case would seem like it's not effectively prevented.
    - cobbzilla 5y ago
      You’re right. Both about the problem still being present and NFT being not strictly necessary anyway. I can’t help but think there must be a way to make it work.
      - Kalium 5y ago
        There probably is, provided you can get a perceptual model that correctly models all human visual perception and reduce it to a hash. I am not sure one exists currently. Until then, it really does seem like we're trying to find a way to re-implement trademarks in a way that doesn't require the interpretive work that trademarks rely on. I suspect there's a lot of complexity hidden in the perceptual model requirement, though.

Kalium 5y ago

Thank you! This is a deeply underappreciated point. I understand how annoying, painful, and disruptive to the user experience it is to have part of your app taken over by browser or OS default widgets and behavior is. It's sheer hell on UX. Yet the custom styling that would make it integrate smoothly would be a godsend for attackers and phishers. The role that UX - and misuses of UX - play in security is often not considered deeply by highly sophisticated users.

Aeolun 5y ago
I’m kind of inclined to think that completely indefferentiated username and password forms are much more of a godsent?
jamil7 5y ago
Is this actually hell on UX or is that something product people and designers tell us because it’s in their personal interest to create custom solutions for every webapp? iOS apps pretty regularly defer user actions to OS level controls and prompts and frankly I believe the UX there is far superior to webapps using bespoke UX for these. Wouldn’t standardised browser behaviour and OS level styling for common flows and behaviour be a big win for webapps and take some of the drudgery out of web development?
- Kalium 5y ago
  Like you, I suspect it's not, but I've found that leading with telling people that the thing they deeply want to believe is wrong is a poor way to convince them of things. You have to go through a ritualistic performance of empathy first.
maficious 5y ago
What prevents the hacker from cloning the whole web-page of, say, facebook.com login and phish users for credentials this way? This is not a hyphotetical thing, Kali Linux even bundles a utility program for that. Compared to that, one icon, that is the same as that of the company, is not that threatening. Not only that, but if you consider a sign in form that wouldn't have a logo, it would be way easier to trick user into putting their credentials in, because the user wouldn't be able to differentiate them. Also OAuth is always branded AFAIK. Users may also notice discrepancies in the logo, if it was cloned poorly. Though I can't think of a way someone couldn't forge a logo given all the possibilities. Adobe Illustrator can trace images into svg and there's plenty of companies' svg logos just in the google search.

lordlimecat 5y ago

You can already do this. As always the only defense is to compare what is being asked for with the FQDN.