3 ms·
<evil> I wonder how difficult it'd be to build a fullscreen browser replacement and have it load automatically. The fake browser could mimic real browser actio
by misterbwong 15y ago
<evil>
I wonder how difficult it'd be to build a fullscreen browser replacement and have it load automatically. The fake browser could mimic real browser actions and easily mask the url (and all of the browser chrome, for that matter) and inject their own content when a user navigates to an interesting site. All the normal "safe" markers (e.g. green URL bar, security lock on the bottom right, the correct URL) could be shown to the user.
Hmm....
</evil>
- jlongster 15y agoThe only way that would be feasible is to use iframes, and you can't inject anything into an iframe.
- mnutt 15y agoIt would be a technical challenge, but they could MITM your entire browsing experience. Fullscreen to canvas, then show what looks like a browser. When someone types something in the URL bar the attacker's backend proxies a request to the real site, loads the content, then renders a canvas page of it. It would probably be too much work for too little payoff to actually make a browser that rendered to canvas, but they could do it for a couple of major target sites like gmail and banks.
- akx 15y agoWell... http://html2canvas.hertzen.com/ http://html2canvas.hertzen.com/