4 ms·

Why would you ever need to enter your browser into the search mechanism? I just don't get it. If you're having this problem, I hear Common Sense 2013 is a grea

Why would you ever need to enter your browser into the search mechanism? I just don't get it. If you're having this problem, I hear Common Sense 2013 is a great browser security package.

jonnykramer 14y ago
I'm not sure I understand you correctly, but the browser you are using can be ascertained with JavaScript or a server side script.
- hayksaakian 14y ago
  sorry, it was autocorrect, meant to type 'password' became 'browser'
gojomo 14y ago
Your OS/browser already identifies itself, so they know which look to fake. The trick is to convince someone to try finding something sensitive on the page. This might be done by showing a long list of 'leaked' passwords or social-security-numbers. Even without explicit prompting, some people might Ctrl-F search for their own, with a false confidence that a local search isn't shared with the page.
InclinedPlane 14y ago
It's just social engineering, but done in a rather slick fashion. Normally one wouldn't expect that a password or credit card number or social security number would ever be typed into a search box for a web page. Except, what if you posted a page of compromised passwords or other data? Then someone might go to that page and search for their own secret information, to see if it had been leaked. They wouldn't even think twice about this because normally the information in a search box is secure, and known only to the browser. But if a site creates an html based search box that is hooked into ctrl-F then the user might divulge their secret information without even knowing.
- hayksaakian 14y ago
  That's my problem with the whole situation. The headline paints it as a technical flaw, where in reality it's human error.
  - deleted 14y ago
    [deleted]
  - sliverstorm 14y ago
    It's not a flaw in the strictest sense, but it is a sort of a shortcoming. Does anybody think websites remapping your basic hotkeys is a good idea?
  - InclinedPlane 14y ago
    That's a very wrong way of thinking about the problem. It's not actually a human error except in the strictest sense. Imagine if the mechanism for flying an airplane involved a thousand different levers that all need to be carefully moved in concert in order to avoid crashing. Is crashing such an unflyable plane a "human error"? The problem here is that browsers allow overiding ctrl-f and almost no users realize this is possible. It's not just a human problem, it's also a browser design problem. Browser makers have trained their users to trust that pressing ctrl-f will pull up a find dialog, it's as much their fault as it is user's fault.
  - freditup 14y ago
    When I posted this article, I considered changing the title because I agree that it is somewhat sensationalist and slightly misleading. I chose just to keep the actual article headline because I couldn't think of anything better at the moment. Would it have been better to change it? (I honestly don't know the HN norms)

Why would you ever need to enter your browser into the search mechanism? I just don't get it. If you're having this problem, I hear Common Sense 2013 is a great browser security package.

jonnykramer 14y ago

I'm not sure I understand you correctly, but the browser you are using can be ascertained with JavaScript or a server side script.

hayksaakian 14y ago
sorry, it was autocorrect, meant to type 'password' became 'browser'

gojomo 14y ago

Your OS/browser already identifies itself, so they know which look to fake. The trick is to convince someone to try finding something sensitive on the page. This might be done by showing a long list of 'leaked' passwords or social-security-numbers. Even without explicit prompting, some people might Ctrl-F search for their own, with a false confidence that a local search isn't shared with the page.

InclinedPlane 14y ago

It's just social engineering, but done in a rather slick fashion. Normally one wouldn't expect that a password or credit card number or social security number would ever be typed into a search box for a web page. Except, what if you posted a page of compromised passwords or other data? Then someone might go to that page and search for their own secret information, to see if it had been leaked. They wouldn't even think twice about this because normally the information in a search box is secure, and known only to the browser. But if a site creates an html based search box that is hooked into ctrl-F then the user might divulge their secret information without even knowing.

hayksaakian 14y ago
That's my problem with the whole situation. The headline paints it as a technical flaw, where in reality it's human error.
- deleted 14y ago
  [deleted]
- sliverstorm 14y ago
  It's not a flaw in the strictest sense, but it is a sort of a shortcoming. Does anybody think websites remapping your basic hotkeys is a good idea?
- InclinedPlane 14y ago
  That's a very wrong way of thinking about the problem. It's not actually a human error except in the strictest sense. Imagine if the mechanism for flying an airplane involved a thousand different levers that all need to be carefully moved in concert in order to avoid crashing. Is crashing such an unflyable plane a "human error"? The problem here is that browsers allow overiding ctrl-f and almost no users realize this is possible. It's not just a human problem, it's also a browser design problem. Browser makers have trained their users to trust that pressing ctrl-f will pull up a find dialog, it's as much their fault as it is user's fault.
- freditup 14y ago
  When I posted this article, I considered changing the title because I agree that it is somewhat sensationalist and slightly misleading. I chose just to keep the actual article headline because I couldn't think of anything better at the moment. Would it have been better to change it? (I honestly don't know the HN norms)