6 ms·

> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 https://twitter.com/aripalo/status/462942544007929857 The te

> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best. > Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on a login page. That's actually very, very hard (as in np-hard). Chrome has heuristics for detecting login pages, but it doesn't even detect all legitimate login pages. And it's trivial for a phisher to intentionally make a page that appears exactly like a login page to the user, but will not be detected by Chrome's heuristics.

tmzt 12y ago
You could detect forms that have more than one user provided input field as they are submitted. This wouldn't detect most search boxes or forms that use hidden inputs to transmit values to the backend.
ghayes 12y ago
But `input[type="password"]` would cover the majority of login forms. At the least, it would force the con-artist have to mimic a native password box, which is more likely to get caught by the end-user.
- nodata 12y ago
  Yes. Anything that doesn't use a password field is normally a giant hack anyway.
- nyrina 12y ago
  So facebook's mobile login page wouldn't trigger, for example. It's not as simple as peolpe think of it. It never is.
altcognito 12y ago
> That's actually very, very hard (as in np-hard). Chrome has heuristics for detecting login pages, but it doesn't even detect all legitimate login pages. And it's trivial for a phisher to intentionally make a page that appears exactly like a login page to the user, but will not be detected by Chrome's heuristics. Well, it wouldn't have to detect all login pages, it could just detect most of them. That would add soft pressure to encourage regular websites to use HTTPS in the vein of https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere Hopefully we can push the web towards https everywhere, and users begin to ask the question -- "Why is this page not secure" when performing a login. This soft pressure worked wonders in a number of places: When Google started doing sitelinks, many websites became much more concerned about making those available on their website. In a similar way, hopefully they would be concerned with getting out of the red for their login pages.
baddox 12y ago
It's not even NP-hard, because it's not well-defined and thus isn't even a decision problem.

tmzt 12y ago

You could detect forms that have more than one user provided input field as they are submitted. This wouldn't detect most search boxes or forms that use hidden inputs to transmit values to the backend.

ghayes 12y ago

But `input[type="password"]` would cover the majority of login forms. At the least, it would force the con-artist have to mimic a native password box, which is more likely to get caught by the end-user.

nodata 12y ago
Yes. Anything that doesn't use a password field is normally a giant hack anyway.
nyrina 12y ago
So facebook's mobile login page wouldn't trigger, for example. It's not as simple as peolpe think of it. It never is.

altcognito 12y ago

> That's actually very, very hard (as in np-hard). Chrome has heuristics for detecting login pages, but it doesn't even detect all legitimate login pages. And it's trivial for a phisher to intentionally make a page that appears exactly like a login page to the user, but will not be detected by Chrome's heuristics. Well, it wouldn't have to detect all login pages, it could just detect most of them. That would add soft pressure to encourage regular websites to use HTTPS in the vein of https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere Hopefully we can push the web towards https everywhere, and users begin to ask the question -- "Why is this page not secure" when performing a login. This soft pressure worked wonders in a number of places: When Google started doing sitelinks, many websites became much more concerned about making those available on their website. In a similar way, hopefully they would be concerned with getting out of the red for their login pages.

baddox 12y ago

It's not even NP-hard, because it's not well-defined and thus isn't even a decision problem.