3 ms·

The point of that article was that people don't notice subtle changes, especially when their not tech savvy/tired after a long day of work/whatever. Also someo

The point of that article was that people don't notice subtle changes, especially when their not tech savvy/tired after a long day of work/whatever. Also someone pointed out in the comments that some people tend to ignore changes and click on whatever to get to their destination.

JustGotHere 12y ago
And article is ignoring that the site can then add https and do that fullscreen attack anyway. A better solution would be to keep showing a message telling you it has gone fullscreen like browsers currently do.
bd 12y ago
Yes, that's true. But for people who don't notice changes there isn't much help anyways. Even much more primitive phishing will still work on them (just think about those "you have virus / clean your computer" ads from past, with images looking like Windows pop-ups, or remember how those "Nigerian prince" scams intentionally use broken English to selectively address more gullible folks). These new proposed security measures will not help those people much, they can still be phished from within browser tab content rectangle. Instead these changes will just basically kill whole class of web applications for a benefit of small subset of population phishable enough with fullscreen attacks but immune to content rectangle attacks. ----- BTW recent Lenovo Superfish fiasco has shown us that in fact you can't even trust native browser security UI elements. Those real UI green locks on https pages can be as misleading as those JS/HTML generated ones. I would much more prefer browsers to secure me from known rogue certificates attacks than from hypothetical hard-to-pull-off fullscreen phishing attacks.
TeMPOraL 12y ago
And that's one of the reasons webapps will be always second-class citizens vs. native apps - because browsers have to limit tons of useful features to keep users protected from various attacks.

JustGotHere 12y ago

And article is ignoring that the site can then add https and do that fullscreen attack anyway. A better solution would be to keep showing a message telling you it has gone fullscreen like browsers currently do.

bd 12y ago

Yes, that's true. But for people who don't notice changes there isn't much help anyways. Even much more primitive phishing will still work on them (just think about those "you have virus / clean your computer" ads from past, with images looking like Windows pop-ups, or remember how those "Nigerian prince" scams intentionally use broken English to selectively address more gullible folks). These new proposed security measures will not help those people much, they can still be phished from within browser tab content rectangle. Instead these changes will just basically kill whole class of web applications for a benefit of small subset of population phishable enough with fullscreen attacks but immune to content rectangle attacks. ----- BTW recent Lenovo Superfish fiasco has shown us that in fact you can't even trust native browser security UI elements. Those real UI green locks on https pages can be as misleading as those JS/HTML generated ones. I would much more prefer browsers to secure me from known rogue certificates attacks than from hypothetical hard-to-pull-off fullscreen phishing attacks.

TeMPOraL 12y ago

And that's one of the reasons webapps will be always second-class citizens vs. native apps - because browsers have to limit tons of useful features to keep users protected from various attacks.