3 ms·

Does this mean websites can now hijack android’s OS-level back button? In addition to hijacking the browser level one? I hate when I hit back, but instantly re

Does this mean websites can now hijack android’s OS-level back button? In addition to hijacking the browser level one? I hate when I hit back, but instantly redirect to the same page. This is so frustrating when it happens. And it happens even on major sites. (Microsoft’s official community “answers” forums have given me this issue lately. Fills up search results and then traps you there)

candiddevmike 3y ago
I'm seeing this a lot with news sites, they'll redirect your back press to a page screen with bunch of click bait headline/images. Some of them are pretty disturbing at first glance, seems like they're trying to get shocking images in front of you to keep you engaged. I think they're trying to fight against news aggregators but it's such a shitty idea. The funny/sad thing is the folks adding this functionality are probably reading my comment. You should be ashamed of yourselves.
- derekp7 3y ago
  A more evil version of this is detecting which news aggregator sent you there, then making that clickbait page look like the source aggregator. I've seen this with the news feed from Chrome on Android, clicking on a store then going back I thought I was back on the news feed but the stories just didn't look right.
  - Zuiii 3y ago
    This could totally be used for phishing, right? Open a link in gmail -> go to nasty site -> press back and see google login page that's actually still the nasty site. Browsers should prevent cross origin sites from seeing where the visitor came from (i.e. clear referrer). Also, why doesn't the back button disable any automatic (non-user initiated) redirects on pages loaded that way? Seems like an obvious fix to the history loops we keep seeing.
    - sroussey 3y ago
      Websites have a lot of control over referrer headers these days. Often, news aggregators add to urls so the site knows where it came from, or it’s using a feed that already has that. Now, that said, in an email, you can send links that encode that it’s coming from email, but you would get caught by the non-gmail using people suddenly seeing fake gmail.
      - Zuiii 3y ago
        The pessimist in me says that most will probably try to log in anyway.
- morkalork 3y ago
  Ah, the ye olde chum bucket
- doctor_radium 3y ago
  I am starting to make a collection of such sites. Wonder if UBlock Origin would be interested in adding them to a new or existing "annoyances" filter list?
dr_kiszonka 3y ago
(I don't know if it is OS-level.) If you have the GitHub Android app installed, GitHub links open in the app. In the app, swiping right (back) takes you to the app's home screen and not to where you clicked the link (e.g., the HN app). The same isn't true for many other apps. Also, GitHub team, could you make your app better? It has so many little annoyances.
progman32 3y ago
Kind of. There is a mitigation in the spec https://github.com/WICG/close-watcher#abuse-analysis https://github.com/WICG/close-watcher#abuse-analysis Briefly, the user may need to press back a couple times in order to escape, but the maximum number of presses needed is bounded and is dependent on how much the user interacts with the page. Of note, closing the tab bypasses this API entirely, at least according to that page.
saghm 3y ago
Usually my back button on my phone already just does the browser back functionality when the browser is open, which does mean it gets hijacked. Sometimes if I mash the back button enough I'll manage to sneak a trigger throughout whatever dumb thing the site implemented to try to stop me though, so I'm loath to give them any other tools to try to detect this.
- Gare 3y ago
  Long press on the back button usually works
- inquirerGeneral 3y ago
  [dead]

candiddevmike 3y ago

I'm seeing this a lot with news sites, they'll redirect your back press to a page screen with bunch of click bait headline/images. Some of them are pretty disturbing at first glance, seems like they're trying to get shocking images in front of you to keep you engaged. I think they're trying to fight against news aggregators but it's such a shitty idea. The funny/sad thing is the folks adding this functionality are probably reading my comment. You should be ashamed of yourselves.

derekp7 3y ago
A more evil version of this is detecting which news aggregator sent you there, then making that clickbait page look like the source aggregator. I've seen this with the news feed from Chrome on Android, clicking on a store then going back I thought I was back on the news feed but the stories just didn't look right.
- Zuiii 3y ago
  This could totally be used for phishing, right? Open a link in gmail -> go to nasty site -> press back and see google login page that's actually still the nasty site. Browsers should prevent cross origin sites from seeing where the visitor came from (i.e. clear referrer). Also, why doesn't the back button disable any automatic (non-user initiated) redirects on pages loaded that way? Seems like an obvious fix to the history loops we keep seeing.
  - sroussey 3y ago
    Websites have a lot of control over referrer headers these days. Often, news aggregators add to urls so the site knows where it came from, or it’s using a feed that already has that. Now, that said, in an email, you can send links that encode that it’s coming from email, but you would get caught by the non-gmail using people suddenly seeing fake gmail.
    - Zuiii 3y ago
      The pessimist in me says that most will probably try to log in anyway.
morkalork 3y ago
Ah, the ye olde chum bucket
doctor_radium 3y ago
I am starting to make a collection of such sites. Wonder if UBlock Origin would be interested in adding them to a new or existing "annoyances" filter list?

dr_kiszonka 3y ago

(I don't know if it is OS-level.) If you have the GitHub Android app installed, GitHub links open in the app. In the app, swiping right (back) takes you to the app's home screen and not to where you clicked the link (e.g., the HN app). The same isn't true for many other apps. Also, GitHub team, could you make your app better? It has so many little annoyances.

progman32 3y ago

Kind of. There is a mitigation in the spec https://github.com/WICG/close-watcher#abuse-analysis https://github.com/WICG/close-watcher#abuse-analysis Briefly, the user may need to press back a couple times in order to escape, but the maximum number of presses needed is bounded and is dependent on how much the user interacts with the page. Of note, closing the tab bypasses this API entirely, at least according to that page.

saghm 3y ago

Usually my back button on my phone already just does the browser back functionality when the browser is open, which does mean it gets hijacked. Sometimes if I mash the back button enough I'll manage to sneak a trigger throughout whatever dumb thing the site implemented to try to stop me though, so I'm loath to give them any other tools to try to detect this.

Gare 3y ago
Long press on the back button usually works
inquirerGeneral 3y ago
[dead]