4 ms·
Thank you! This is a deeply underappreciated point. I understand how annoying, painful, and disruptive to the user experience it is to have part of your app ta
by Kalium 5y ago
Thank you! This is a deeply underappreciated point.
I understand how annoying, painful, and disruptive to the user experience it is to have part of your app taken over by browser or OS default widgets and behavior is. It's sheer hell on UX. Yet the custom styling that would make it integrate smoothly would be a godsend for attackers and phishers.
The role that UX - and misuses of UX - play in security is often not considered deeply by highly sophisticated users.
- Aeolun 5y agoI’m kind of inclined to think that completely indefferentiated username and password forms are much more of a godsent?
- jamil7 5y agoIs this actually hell on UX or is that something product people and designers tell us because it’s in their personal interest to create custom solutions for every webapp? iOS apps pretty regularly defer user actions to OS level controls and prompts and frankly I believe the UX there is far superior to webapps using bespoke UX for these. Wouldn’t standardised browser behaviour and OS level styling for common flows and behaviour be a big win for webapps and take some of the drudgery out of web development?
- Kalium 5y agoLike you, I suspect it's not, but I've found that leading with telling people that the thing they deeply want to believe is wrong is a poor way to convince them of things. You have to go through a ritualistic performance of empathy first.
- maficious 5y agoWhat prevents the hacker from cloning the whole web-page of, say, facebook.com login and phish users for credentials this way? This is not a hyphotetical thing, Kali Linux even bundles a utility program for that. Compared to that, one icon, that is the same as that of the company, is not that threatening. Not only that, but if you consider a sign in form that wouldn't have a logo, it would be way easier to trick user into putting their credentials in, because the user wouldn't be able to differentiate them. Also OAuth is always branded AFAIK. Users may also notice discrepancies in the logo, if it was cloned poorly. Though I can't think of a way someone couldn't forge a logo given all the possibilities. Adobe Illustrator can trace images into svg and there's plenty of companies' svg logos just in the google search.