Malware in the browser: how you might get hacked by a Chrome extension

Re:Malware in the browser: how you might get hacked by a Chr... by zeta0134 on Monday July 18, 2016 @02:12PM (#12116980)

I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements.

Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.

[ Parent | on HN ]

Re:Malware in the browser: how you might get hacked by a Chr... by greggman on Monday July 18, 2016 @09:32PM (#12118986)

Firefox and Safari already don't use the OS modal dialog and Chrome is working on it

https://docs.google.com/document/d/1wtV5rmLhbf1OZkbg7crtCt6h...

[ Parent | on HN ]

Re:Malware in the browser: how you might get hacked by a Chr... by atomwaffel on Monday July 18, 2016 @03:45PM (#12117615)

> Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome?

Firefox and Safari do exactly that.

> The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.

Does that work? I've never seen any pages that circumvent alert blocking like that, and I'd have imagined that any sensible implementation would disable alerts for the entire session (or at least a few minutes).

[ Parent | on HN ]

Re:Malware in the browser: how you might get hacked by a Chr... by zeta0134 on Monday July 18, 2016 @08:53PM (#12118865)

I don't know what the exact exploit of the behavior is, but I've observed it on several "infected" computers while working in tech support. I've seen it on Internet Explorer, Microsoft Edge, Google Chrome, and some variation of it on Safari, all of which I was only able to remedy by forcefully closing the browser using the task manager or equivalent.

Truthfully, I have not actually observed this behavior on Firefox, and I'm quite thankfully no longer in the business of providing technical support to personal computer users, so hopefully I never will.

[ Parent | on HN ]

Re:Malware in the browser: how you might get hacked by a Chr... by ocdtrekkie on Monday July 18, 2016 @11:37PM (#12119411)

I had my words at an Edge developer about this problem, and they seemed at least interested in my feedback. So here's hoping Edge fixes this too.

[ Parent | on HN ]

Re:Malware in the browser: how you might get hacked by a Chr... by heinrich5991 on Monday July 18, 2016 @03:42PM (#12117590)

That's at least what Firefox does.

[ Parent | on HN ]