4 ms·

This is really just an extension of clickjacking - modifying the UI to trick the user into performing an undesired action. This is a pretty novel idea, and cons

This is really just an extension of clickjacking - modifying the UI to trick the user into performing an undesired action. This is a pretty novel idea, and considering how many websites make use of this to slap their permalinks into copied text (albeit with flash, usually), I'm surprised this hasn't been thought of before. It would be an interesting experiment to sneak a harmless command after every snippet on a site like commandlinefu.com. Edit: Also while playing around, I remembered irssi actually has a defense against this. If you try pasting multiple lines, it can detect this. It presents you with a prompt asking if you really intended to paste >5 lines into the text field. I wonder if something like this could be implemented in a shell?

icebraining 14y ago
Even if the shell had such protection, they could just do 'evil command && visible command'.
- bluetooth 14y ago
  Good point.
- TheJH_ 14y ago
  If the shell had a protection against text pasted together with an ending newline (and would just strip that newline), it would help, I think.
oelmekki 14y ago
> This is really just an extension of clickjacking That's was my first thought too, but in fact, it's quite the reverse of clickjacking (even though the same basic idea is used). With clickjacking, you would positionate some opacity:0 link on top of some apparently legit link. Here, on the contrary, the malicious content is within the apparently legit content, then moved away with css (setting opacity to 0 would not do the trick). Not a big difference, but that would deserve a dedicated name, IMO.