4 ms·
We Want Chromeless: https://vimeo.com/95800398 https://vimeo.com/95800398 Get Involved: http://code.higg.im/chromeless/ http://code.higg.im/chromeless/ For the
by getdavidhiggins 12y ago
We Want Chromeless: https://vimeo.com/95800398 https://vimeo.com/95800398
Get Involved: http://code.higg.im/chromeless/ http://code.higg.im/chromeless/
For the security pedants, I didn't overlook security:
Before Fullscreen got launched, there was a heated discussion on the possible security implications of Fullscreen. Couldn't attacker X just mimic a fake browser window, simulate a bank's login screen (address bar et al), and steal login info? Phishing does the exact same thing, but the URL is always cunningly disguised as the real URL. For example: http://bankofamerica.com.87654321.com/login.do. With an exact replica of the Operating System, as-well, as a browser mockup, it can be quite possible to mimic the real URL, so all the user sees is http://bankofamerica.com/login.do.
When fullscreen got launched, obviously the Mozilla team did their homework. Firstly, the user knows very well they're entering fullscreen mode (via a very well placed message). As-well as this, the user always has to "click", or otherwise activate Fullscreen through a button. Click-jacking, however is out of the question with Fullscreen. (I've tried it). You can't fire-up Fullscreen by emulating a click. So with this in mind, Chromeless Windows should adapt the same pattern.
- getdavidhiggins 12y agoAlso noteworthy: Using the HTML5 Fullscreen API for Phishing Attacks http://feross.org/html5-fullscreen-api-attack/ http://feross.org/html5-fullscreen-api-attack/ Mozilla Full-screen API Security Review https://wiki.mozilla.org/Security/Reviews/Firefox10/CodeEditor/FullScreenAPI https://wiki.mozilla.org/Security/Reviews/Firefox10/CodeEdit...