5 ms·

Looks like the perfect place to fake some browser chrome and trick people... https://www.theregister.com/2017/01/19/browser_line_of_death/ https://www.theregis

Looks like the perfect place to fake some browser chrome and trick people... https://www.theregister.com/2017/01/19/browser_line_of_death/ https://www.theregister.com/2017/01/19/browser_line_of_death...

nicoburns 4y ago
I think you'll only get access to this API if the user has explicitly installed your app as a PWA, not just when visiting it as a webpage.
- gildas 4y ago
  And then a shady company offers to buy the owner's website...
  - tshaddox 4y ago
    That’s a real problem, of course, but it seems fairly equivalent to any native app you install that can update itself or otherwise make a network request to obtain instructions.
    - gildas 4y ago
      I agree with you. On the other hand, in the case of a native application, we can hope that the antivirus removes it. I hope that Microsoft has planned to update Defender accordingly.
      - int_19h 4y ago
        JavaScript malware has been a thing for a while now, and antiviruses have been targeting it accordingly.
        gildas 4y ago
        It's not necessarily a JavaScript malware. A pure HTML page with a <form> tag could suffice to steal credentials.
      - postalrat 4y ago
        Unlike the native app you probably won't have to worry about web page encrypted your files and asking a ransom.
        bentcorner 4y ago
        For now
    - sneak 4y ago
      Native apps that autoselfupdate have RCE vulnerabilities by definition and should be considered remote access malware already, before the developer release keys are compromised. I am the reason Signal desktop now has a preference to opt out of autoupdate.
      - hulitu 4y ago
        "It won't happen to me."
- jb_s 4y ago
  XSS will mean that attackers control browser UI, that's kind of bad
  - hulitu 4y ago
    Bad ? I thought that was a feature. "Want to change your browser behaviour ? Just put this CSS in user.js".
drewzero1 4y ago
That was my first thought as well, but I couldn't remember the name for that boundary. I hope there is a well-designed per-site control/setting/user consent system to keep tech support scam sites (or worse!) from adding one more tool to their arsenal.
- deleted 4y ago
  [deleted]
- fiddlerwoaroof 4y ago
  I’ve seen it called “The Line of Death” https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/

nicoburns 4y ago

I think you'll only get access to this API if the user has explicitly installed your app as a PWA, not just when visiting it as a webpage.

gildas 4y ago
And then a shady company offers to buy the owner's website...
- tshaddox 4y ago
  That’s a real problem, of course, but it seems fairly equivalent to any native app you install that can update itself or otherwise make a network request to obtain instructions.
  - gildas 4y ago
    I agree with you. On the other hand, in the case of a native application, we can hope that the antivirus removes it. I hope that Microsoft has planned to update Defender accordingly.
    - int_19h 4y ago
      JavaScript malware has been a thing for a while now, and antiviruses have been targeting it accordingly.
      - gildas 4y ago
        It's not necessarily a JavaScript malware. A pure HTML page with a <form> tag could suffice to steal credentials.
    - postalrat 4y ago
      Unlike the native app you probably won't have to worry about web page encrypted your files and asking a ransom.
      - bentcorner 4y ago
        For now
  - sneak 4y ago
    Native apps that autoselfupdate have RCE vulnerabilities by definition and should be considered remote access malware already, before the developer release keys are compromised. I am the reason Signal desktop now has a preference to opt out of autoupdate.
    - hulitu 4y ago
      "It won't happen to me."
jb_s 4y ago
XSS will mean that attackers control browser UI, that's kind of bad
- hulitu 4y ago
  Bad ? I thought that was a feature. "Want to change your browser behaviour ? Just put this CSS in user.js".

drewzero1 4y ago

That was my first thought as well, but I couldn't remember the name for that boundary. I hope there is a well-designed per-site control/setting/user consent system to keep tech support scam sites (or worse!) from adding one more tool to their arsenal.

deleted 4y ago
[deleted]
fiddlerwoaroof 4y ago
I’ve seen it called “The Line of Death” https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/