In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts.

Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message.

People will just assume they made a typo and continue as if nothing happened.

I've argued before for a genuine out-of-band independent display on machines which can only be written to by some very high privilege process.

That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.

Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face.

Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.

how is it worse? touch id’s serving as authentication and approval for payment was actually exploited as a scam. I don’t see how this could be done with face id.

https://www.wired.com/story/iphone-touch-id-scam-apps/

That’s fair. I never encountered anything like that. In my experience Touch ID was faster, more reliable, and more versatile (e.g. able to be activated with the phone lying on a table without peering over it with my face).

I happen to be in a situation where I have a phone with Face ID and one with Touch ID.

Touch ID with wet or slightly dirty fingers are not good. I've been doing some gardening over Easter and Touch ID is barely working because my fingers are more rough than they normally are.

Face ID on the other hand, works just as expected. It doesn't work optimally if I'm lying down, but that's not a problem for me personally.

Maybe is up to implementation? I've got an X and the intent to pay pops up the native pay modal, which still requires you to double press the power button AND to be authenticated. So what you say never really happens.

Yes, but it isn't very effective because if the computer is left with the login screen visible after Ctrl+alt+del opened in a full screen browser, users will simply proceed directly to typing their credentials. Then an endless logging in dialog could be presented, so that the user thinks it is a problem with the computer.

Hmm not if your users are trained to press Ctrl-Alt-Del again... The login screen would also allow them to order the OS to log off the current session too.

now i know why it makes me type that every time :D guess i never wondered. thanks!

Mine would log you in. Of course the OS (Oasis) had a way to exec the login program and feed it the password. I stole the teacher’s password and then changed it.

He busted me by booting up the system from floppy and typed in the commend to format the hard drive and waited for me to return to the lab after school. I asked him what he was doing and he said he had no choice but to reinstall from scratch because someone changed the password. He then moved to hit the Enter key.

Not wanting my fellow students to lose their projects, I confessed. I logged him in and he changed the password.

He then gave my account admin privileges. I guess I had earned them.

Interesting reaction. What was the thought process behind it? E.g. what did you use them for

I became the help desk. It seemed like an elevated status but in reality it meant I got some of the drudgery piled on to me. Password changes, adding students, disk quota increases and such.

Why would someone that could boot a system from floppy have to "format the hard drive" instead of just setting a new password?

The instructor had the only admin account and I had changed the password to his account; he was locked out.

Back in the day I made a near-perfect copy of the RM (UK school IT supplier) login page in Visual Basic 6, and had it run on computers with RunServices registry entry. Had a team of mates with custom floppy disks going around installing it on as many PCs as we could. It would log the supplied user/pw to disk, then display the "wrong password" error, then quit, then exposing the real login screen.

What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.

> Criminal charges

Heh, I don't think so. Teachers don't like to send their pupils to court for silly things. They'd just get told why not to do it again and probably get some detention and stuff.

At a uni, the consequences might be more severe.

Yeah it's not like you did anything illicit like change grades or wreak havoc on the network by mass formatting computers, unless you intentionally left out those parts ;)

As long as you do not start a thermonuclear war with Russia you should be ok.

That exists: look for 'trusted path'. It was a feature of compartmented mode workstation (CMW) operating systems like Trusted Solaris and lives on in the requirement to use Ctrl-Alt-Del to call up the Windows login prompt. In Trusted Solaris (TSOL) it was a dedicated area of the screen—along the bottom—where no user mode process was allowed to write; the OS displayed a special symbol there (sort of like the padlock in a web browser) when the user was interacting directly with the OS. Some CMW systems even implemented that functionality in hardware, electronically compositing windows from different physical frame buffers to the video display. Ctrl-Alt-Del is actually in hardware, too (or it used to be); the keyboard interface on the first IBM PC detected that specific key combination and toggled the reset line on the CPU (or maybe it was an interrupt; I forget). Every subsequent PC-compatible machine, to this day, has the same functionality built in to the hardware, on the A20 reset line. It's mostly vestigial today.

This was how I gained full sysadmin access to our college's VAX 11/780 mini computer in late 1986. This machine ran pretty much everything from accounting to exam marking. There were three terminals that the admins would logon to pretty much regularly on the "student" side of the computer room. I knocked up a script to run on these three terminals that looked exactly like the standard login and mailed me the credentials entered before displaying the standard "incorrect username/password" (and then silently logoff). The risk for me, had the IT team been a bit more up on their game, was spotting my account being logged into these three terminals for long periods of time with me no-where to be seen :)

I kept silent about this until years afterwards for fear of being chucked out of college, which to be honest would've been a good thing seeing as the course was a waste of time.

I mocked up something similar on a VAX system at school as well.

We did just that with our Novell Network school computers.

Show a fake login prompt. Write down what gets entered, show wrong password and exit to real prompt.

What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.

Back in the days (1990) I found amusing to edit the autoexec.bat on my first CS session and add « You have a virus... of the flu », and signed with my pseudo.

Made me and my friend laugh.

Next session the teacher ask us to sit at the same computer, and after 20mn a guy come to me and ask « Are you pseudo ? »

Turns out that the computers really had viruses and they thought it was me !

They threatened to expel me (more to frighten me I think since they had no proof), and made me the cleaning guy for all the semester.

It gave me an undeserved reputation of the guy who hacked the university computers. And a better sense of caution.

In 1990 I also edited a friend's autoexec.bat to launch a quick basic script that would falsely check the disk for viruses and then prompt the user to delete their entire hard disk. Of course pressing "n" would print "y" on the screen and then display a fake progress bar along with a warning to not interrupt the operation in order to avoid disk damage.

I definitely had too much free time at the times. :)

In high school I replicated the entire login UI of NT LAN manager (I think it was called) and had it save the password and then crash the machine (via c:\con\con). Asked the teacher to login for something and tada, admin password.

If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux).

> If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux).

Seems you're not familiar with Linux. It had SAK since forever.

I have never seen a SAK-before-login notice on any linux machine. Only one institutional setting, I suppose.

It doesn't look like the implementation is any good though. First, you have to set it up manually. I've literally never seen anyone do that. Second, it works by killing X. Not exactly elegant. But most importantly you don't have to use the SAK to log in! That's kind of the whole point of it.

It should be "Press ctrl-alt-delete to log in", not "By the way you can press ctrl-alt-delete if you want" because then nobody will bother!

> Second, it works by killing X. Not exactly elegant.

It works by killing everything on that particular terminal, no matter if it's text based or graphical. That's the whole point: whatever spawns after that is created by the init system.

> But most importantly you don't have to use the SAK to log in! That's kind of the whole point of it.

> It should be "Press ctrl-alt-delete to log in", not "By the way you can press ctrl-alt-delete if you want" because then nobody will bother!

I can guarantee you, if I were to copy the design of the login screen that shows up after you press ctrl-alt+del, 99.999% of people who don't work in IT won't bat an eye and enter their credentials straight away. It comes down to educating your users. If you don't explain your users why they have to press it before logging in, they will write it off as just random computer stuff they don't understand and only do so because they get prompted to do so. If next time around they don't, they don't care.

So it comes down to educating your users, and I could very well train them to press alt-print-k before logging in, whereas I agree that a friendly reminder on the login screen is a plus.

In office, adding screenshot visual studio startup splash screen to the wallpaper and watch the dev. Best moment is when they see visual studio being first thing to start after system reboot.

The company where I first worked out of university had a custom which the CEO named ‘shemaling’. The company had quite strict security standards. It was encouraged that anyone who found an unlocked screen in the office would ‘shemale’ the wallpaper. It did the job. I never forgot again after being ’shemaled’ the first time.

I gay porned an entire company's computers after they refused to crack down on employees watching people being murdered all day. They threatened to fire me so I explained exactly why I had done this and that I would happily explain this at length in any subsequent employment tribunal. I kept my job and the management finally told everyone to stop watching people getting killed on company time.

WTF.... Who the hell would watch murder clips at work and how would management be okay with this, let alone on company time?? Unbelievable....

My co-workers thought it hilarious to line up clips of people being run over by trains or having their throat cut, then tell unsuspecting people that they had something very important to show them. Management didn't like being bothered by people complaining about what they viewed as guys being guys. Until they got an eyeful of guys doing guys, that is.

At a previous job, we had a "pipi" mailing list (pee, in French), where people would send "I went to pee" from unlocked computers. The "victim" themselves would often be members of said mailing list. That worked quite well, so organically, the list ended up being used mainly for random jokes, news and stuff, rather than the "I went to pee" messages.

My last work place did something similar, although using Justin Bieber photographs. I was Biebered a few times.

I'm not sure which is worse.

Downvoting the comment does not downvote the CEO or the practice.

The idea is interesting, and it could've been puppies or some other corny wallpaper that did the trick.

Charming CEO. I'm hoping this was the 90s.

Funnily enough, it was four years ago, somewhere in continental Europe. Things were a bit freer there. I didn't stay there long. I have a lot more interesting stories from that place.

As popularized in "webdude vs. sales guy"

"You can't arrange by penis."

ha I did a similar thing too. Except it was fake error messagebox and on Windows 3.1 (or might have even been 3.0?)

It worked quite effectively on 3.x because you could just minimize progman.exe

We did similar with the dos prompt, which must have been about 1991.

That's the era as me (Windows 3.0 was released in 1990, 3.1 a couple of years later). I'm surprised your school let you have unfettered access to the DOS prompt - that would have gotten abused within minutes at our school. Even the BBC BASIC interpreter ended up getting removed from the network because people like myself would abuse the PC Speaker (which, to be honest, was the last the mischief I'd cause).

Frankly though, I preferred the actual BBC Micros and Amiga's that those IBMs were meant to replace.

Someone I know would constantly leave a macbook unlocked, so I prepared a script that would turn down the volume, whisper the owner's name, open weird sfw pictures online and other mildly annoying things, but not very often (like once a week).

This was meant as a joke, and I never actually went through with it. I know the person very well but it still felt douchebaggy. But the idea was to make an app file, save it to some seemingly legitimate folder, and adding it to the autostart list.

The trick to hide the thing was to drag and drop Safari's logo onto it, and naming the app "Safan": it almost goes unnoticed when checking the Activity Monitor, thanks to the system font's proportions.

Blurred lines aside, for posterity you could name it "Safari Auto-Update Utility" and use an app icon that has the Safari logo coupled with a cog wheel or so.

I thought of something like that, but then the user could kill it as a precaution since an auto-update utility or any other secondary application can be temporarily disabled. Killing "Safari", on the other hand, would terminate everything the user's currently doing in it.

I guess I could have named it Disk Memory Manager or some other important-sounding thing.

'Ghost of Steve Jobs' then.

I have an unquantified theory that the number of users that can distinguish between a Windows 7/8/10 dialog box that is presented directly by the operating system, versus as an image inside a browser coming from external http/https server, is diminishing greatly every year.

Last time I was in Davis CA, someone was trying to get me to sign up to their charity. They had an iPad, and were adamant that the padlock on the screen proved it was secure.

I couldn’t convince them that it was just a picture, and that I could fake it if I wanted to.

Except all the colorblind people who have altered their system defaults enough that anything internal to the browser will look very out of place.

You could always try pulling their system colors in through CSS:

https://www.sitepoint.com/css-system-styles/

Having the entire web be unaccessible is a somewhat poor compromise, though…

Or Linux users.

Which have a lower overall usage of the proprietary chrome browser, as well.

Firefox is the pre-install default for most distros, and only Chromium is provided in default repos.

They're also significantly more likely to use some form of ad and JS blocking.

So until the appearance changes based on the UA and system theme (and maybe can read bookmarks and plugins), this trick mostly affects mobile Chrome users.

"Ceci n'est pas un UI."

Shouldn't it be "Ceci n'est pas une UI."? Since interface is a feminine word in French, the article in front of UI need to be feminine too.

Then it should probably be "une IHM", for "Interface Homme-Machine".

New? I think that was around since IE6 times.

Autohide menu bars are bad designs, and you have this on top of that.

Fullscreen API must be removed from browser for security reasons, new window hints should be removed too.

If everything were standard then a screen reader could confidently identify fraudulent content.

Prolly need some sort of ml to parse every image used on device and tag potentially dangerous ones. Wouldn’t be too expensive on devices with tensor units...

Apparently Apple already reports your offensive photos already, can’t imagine why browsing should be treated differently.

> potentially dangerous ones

How do you define this?

> Apple already reports your offensive photos already

What?

> How do you define this?

Same as every tech company do with tons of other spam types.

> What?

https://techcrunch.com/2017/10/30/no-iphones-dont-have-a-spe...

>> This analysis generally happens inside a sandbox, and very little of what the systems determine makes it outside of that sandbox. There are special exceptions, of course, for things like child pornography, for which very special classifiers have been created and which are specifically permitted to reach outside that sandbox.

Unsure what is Techcrunch's source for this but it kinda makes sense.

This is not new, antivirus software already shows reactive methods do not work.