6 ms·

See the related browser-in-a-browser attack: https://news.ycombinator.com/item?id=30697329 https://news.ycombinator.com/item?id=30697329 The trusted UI battle

See the related browser-in-a-browser attack: https://news.ycombinator.com/item?id=30697329 https://news.ycombinator.com/item?id=30697329 The trusted UI battle has been effectively lost. Or it was not much of a battle in the first place, as an average consumer trusts anything with a lock icon on it, as UX researchers found out in 00s - 10s. WebAuthn and passwordless trust flows are our best hope to stop phishcalypse.

marcosdumay 5y ago
I don't get how that's still useful. (As in, it really shouldn't be. I get what the problems are, they just shouldn't exist.) Pop-up login windows shouldn't be a thing. First because browsers have some hard rules about pop-ups, but also because inter-window communication isn't reliable so doing everything on the same window is easier in every way. Browsers shouldn't let the site open windows as they wish. That's incredibly user-hostile. Take the example from Firefox: if the user allows pop-ups, by default they can only open on tabs, without the focus, and with full chrome. (It took a while for Firefox to get over the usual web culture and restrict the sites, but it seems that other browsers aren't there yet.) And finally, there is the issue with passwords. We just shouldn't be using them on random sites anymore. But browsers just can't innovate.
- jkaptur 5y ago
  Sorry, what would your desired future look like?
  - gowld 5y ago
    1. Visit site A. 2. A links to auth provider site B -- in same window/tab 3. B links back to site A, or user uses Back button -- in same window/tab.
    - marcosdumay 5y ago
      Yep, or do that with redirects if it's better. By the way, this is the standard OAuth flow.
    - MrPatan 5y ago
      4. Auth provider B cancels your account. GG
  - tedunangst 5y ago
    A less homogeneous computing ecosystem.
    - notriddle 5y ago
      I get why you want this, but I'm not sure how it actually work in practice without also sacrificing interoperability. There are a number of reasons why we can basically expect everything to converge on all computers behaving exactly the same, even if the interop standard notionally says they don't have to: * Any observable behavior will eventually be relied upon. You know, Hyrum's Law. * Extending a protocol means that someone, somewhere is behaving differently in response to that protocol extension. This means extending a protocol changes its semantics, and that people will either rely on the extension being supported [1], or they will (accidentally or maliciously) create crap data in the extended namespace and penalize anyone who actually tries to use it [2]. * In other words, there is no such thing as optional features in standards. Either the feature works, and implementations that do not support it get fucked*, or it doesn't work, because the implementations that do not support it had enough clout to make it unusable. * If vendor-locked-in solutions provide a better UX, a lot of people will just use that [3]. Especially if the locked-in version is a superset of the standard, and everyone gradually just moves to the version with proprietary extensions because fixing the interop hazards is more important than whatever feature ties them to a niche implementation. Consider how Linux EEE'ed POSIX. Was there a conspiracy, like with ActiveDirectory and LDAP? Or did it just sort of happen? [1]: https://acko.net/blog/on-variance-and-extensibility/ https://acko.net/blog/on-variance-and-extensibility/ [2]: https://web.archive.org/web/20070508200721/http://www.well.com/~doctorow/metacrap.htm https://web.archive.org/web/20070508200721/http://www.well.c... [3]: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ * By "get fucked", I mean "not interoperable." It might still be usable in a limited context, but that means network effects are working against it instead of for it. I need very, very good reason to use two different web browsers.
- taneq 5y ago
  Any time you use the word ‘should’ (or variants) you’re describing the world as you want it to be, not as it is.
  - marcosdumay 5y ago
    Yes. I picked that word because of its meaning. If anywhere on that comment I gave the impression that it is how I believe things are, it is due to a bad choice of words.
whoisjuan 5y ago
A safeguard against this type of attack is to right-click on buttons and links, and open them in a new tab. That means that you can end up with a lot of tabs open, but it really helps to unmask these types of attacks. Ultimately, I think browser vendors should implement better patterns to discern actual windows from mimicked windows. For example, showing a personal secret signature in the UI above the "line of death". The attacker won't be able to figure out the secret signature so only a legit browser window will be able to display it. Here is a quick wireframe of how it could work: https://cln.sh/0GbV3A https://cln.sh/0GbV3A
- MauranKilom 5y ago
  Many website workflows completely break as soon as you have more than one of it open. Online shop checkouts are at this terrifying intersection of "high stakes" and "almost certain to break if you don't do what 99% of users do".

marcosdumay 5y ago

I don't get how that's still useful. (As in, it really shouldn't be. I get what the problems are, they just shouldn't exist.) Pop-up login windows shouldn't be a thing. First because browsers have some hard rules about pop-ups, but also because inter-window communication isn't reliable so doing everything on the same window is easier in every way. Browsers shouldn't let the site open windows as they wish. That's incredibly user-hostile. Take the example from Firefox: if the user allows pop-ups, by default they can only open on tabs, without the focus, and with full chrome. (It took a while for Firefox to get over the usual web culture and restrict the sites, but it seems that other browsers aren't there yet.) And finally, there is the issue with passwords. We just shouldn't be using them on random sites anymore. But browsers just can't innovate.

jkaptur 5y ago
Sorry, what would your desired future look like?
- gowld 5y ago
  1. Visit site A. 2. A links to auth provider site B -- in same window/tab 3. B links back to site A, or user uses Back button -- in same window/tab.
  - marcosdumay 5y ago
    Yep, or do that with redirects if it's better. By the way, this is the standard OAuth flow.
  - MrPatan 5y ago
    4. Auth provider B cancels your account. GG
- tedunangst 5y ago
  A less homogeneous computing ecosystem.
  - notriddle 5y ago
    I get why you want this, but I'm not sure how it actually work in practice without also sacrificing interoperability. There are a number of reasons why we can basically expect everything to converge on all computers behaving exactly the same, even if the interop standard notionally says they don't have to: * Any observable behavior will eventually be relied upon. You know, Hyrum's Law. * Extending a protocol means that someone, somewhere is behaving differently in response to that protocol extension. This means extending a protocol changes its semantics, and that people will either rely on the extension being supported [1], or they will (accidentally or maliciously) create crap data in the extended namespace and penalize anyone who actually tries to use it [2]. * In other words, there is no such thing as optional features in standards. Either the feature works, and implementations that do not support it get fucked*, or it doesn't work, because the implementations that do not support it had enough clout to make it unusable. * If vendor-locked-in solutions provide a better UX, a lot of people will just use that [3]. Especially if the locked-in version is a superset of the standard, and everyone gradually just moves to the version with proprietary extensions because fixing the interop hazards is more important than whatever feature ties them to a niche implementation. Consider how Linux EEE'ed POSIX. Was there a conspiracy, like with ActiveDirectory and LDAP? Or did it just sort of happen? [1]: https://acko.net/blog/on-variance-and-extensibility/ https://acko.net/blog/on-variance-and-extensibility/ [2]: https://web.archive.org/web/20070508200721/http://www.well.com/~doctorow/metacrap.htm https://web.archive.org/web/20070508200721/http://www.well.c... [3]: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ * By "get fucked", I mean "not interoperable." It might still be usable in a limited context, but that means network effects are working against it instead of for it. I need very, very good reason to use two different web browsers.
taneq 5y ago
Any time you use the word ‘should’ (or variants) you’re describing the world as you want it to be, not as it is.
- marcosdumay 5y ago
  Yes. I picked that word because of its meaning. If anywhere on that comment I gave the impression that it is how I believe things are, it is due to a bad choice of words.

whoisjuan 5y ago

A safeguard against this type of attack is to right-click on buttons and links, and open them in a new tab. That means that you can end up with a lot of tabs open, but it really helps to unmask these types of attacks. Ultimately, I think browser vendors should implement better patterns to discern actual windows from mimicked windows. For example, showing a personal secret signature in the UI above the "line of death". The attacker won't be able to figure out the secret signature so only a legit browser window will be able to display it. Here is a quick wireframe of how it could work: https://cln.sh/0GbV3A https://cln.sh/0GbV3A

MauranKilom 5y ago
Many website workflows completely break as soon as you have more than one of it open. Online shop checkouts are at this terrifying intersection of "high stakes" and "almost certain to break if you don't do what 99% of users do".