7 ms·
Browsers, which seem to replace certain parts of current operating systems, aren't very safe. Here's one more example: "This article explores a phishing techni
by jcynix 5y ago
Browsers, which seem to replace certain parts of current operating systems, aren't very safe. Here's one more example:
"This article explores a phishing technique that simulates a browser window within the browser to spoof a legitimate domain."
- pvg 5y agoThey are reasonably safe, given their size and complexity. They are certainly a lot safer than current widely used operating systems - those aren't designed for running unknown adversarial code at all - something a browser does all the time in typical use.
- mooreds 5y agoThe strength of browsers (universally, near instant code deployment via URL) is also a weakness, unfortunately.
- woah 5y agoWhat alternative do you suggest?
- jer0me 5y agoOpening the auth window in a tab instead of a window would help. Including an avatar and extensions in the popup window and opening it on top of the chrome on the main browser window would help to differentiate it.
- zarq 5y agoEven if browsers did this, you can still execute this attack. As long as not all of your users know what the expected behavior is, you can trick them with a fake UI as long as it looks believable.
- shakna 5y agoThe goal is not to protect 100% of your users, it is to reduce the number of users who are currently vulnerable. One is possible, one is not. If you can significantly reduce the number of users who will fall for an attack, then it is a success, even if not everyone is protected.
- simion314 5y agoA good solution is browser actually implementing useful stuff like needed widgets and useful features. For example have a <login> element , browsers will style it the same for all websites and prevent developer to misled the user.
- gruez 5y ago>For example have a <login> element , browsers will style it the same for all websites and prevent developer to misled the user. more importantly, display to the user in such a way that no website can spoof it. For instance, it can dim the entire window (eg. like UAC on windows).
- metadat 5y agoThis doesn't solve it because theb the phishermen will simply start cloning the <login> element style.
- simion314 5y ago>This doesn't solve it because theb the phishermen will simply start cloning the <login> element style. You do the login in a native popup, similar on how you give say camera permissions.
- godot 5y agoReminds me of the old 90s days of Apache with .htaccess files Auth setup.
- sodality2 5y ago90s? I use that to this day!
- metadat 5y agoThis seems like a decent solution s compared to alternatives presented so far in throughout discussion. Folks who browse in an edge-to-edge maximized window will still be at least somewhat-to-quite vulnerable, especially if less tech-savvy or vision impaired. I generally don't browse this way, mostly due to the relatively insane* width of displays in general these days. Would mobile users still be vulnerable? Due to: 1. Tiny screen dimensions. 2. No option for "window" resizing. It's not even a thing. * OT: Displays today are wide to such an extreme they tend to be too wide for my needs and tastes. Eventually it's too much like staring at the bottom 1/5th of a full-sized 4k display, which work sent me but turns out is mostly good for watching Batman, The Matrix, and other ultra-wide theatrical film releases. Granted, at this task, a 34" 1440p widescreen excels marvelously. Surely you've heard the joke (or is it an adage?): "With that 34" display, it can [finally] render a Java Class Name and fit it within a single line. But after the IDE and debugger open, you can only see the one line.