Re:Popover API
by algasami on Friday May 10, 2024 @09:19AM
(#40318625)
The pessimist inside me worries about whether this could be used to lure people into revealing their credentials; granted, there are thousands of ways to do this easily, but I'm still cautiously optimistic on this topic.
[ Parent
| on HN ]
Re:Popover API
by codelikeawolf on Friday May 10, 2024 @10:38AM
(#40319566)
So I think this API would just allow a bad actor to get your credentials in a way that adheres to accessibility guidelines. It doesn't enable them to do anything they couldn't do before programmatically.
Saw an interesting case of this type of attack in the CounterStrike community earlier this week.
Someone setup a fake tournament website that asked the user to login with their Steam account. Then it launched what looked like a new browser window with the Steam login page, but was actually just a popover that had been elaborately styled, with window decorations and all.