It's just social engineering, but done in a rather slick fashion. Normally one wouldn't expect that a password or credit card number or social security number would ever be typed into a search box for a web page.

Except, what if you posted a page of compromised passwords or other data? Then someone might go to that page and search for their own secret information, to see if it had been leaked. They wouldn't even think twice about this because normally the information in a search box is secure, and known only to the browser. But if a site creates an html based search box that is hooked into ctrl-F then the user might divulge their secret information without even knowing.

That's my problem with the whole situation. The headline paints it as a technical flaw, where in reality it's human error.

That's a very wrong way of thinking about the problem. It's not actually a human error except in the strictest sense. Imagine if the mechanism for flying an airplane involved a thousand different levers that all need to be carefully moved in concert in order to avoid crashing. Is crashing such an unflyable plane a "human error"?

The problem here is that browsers allow overiding ctrl-f and almost no users realize this is possible. It's not just a human problem, it's also a browser design problem. Browser makers have trained their users to trust that pressing ctrl-f will pull up a find dialog, it's as much their fault as it is user's fault.

It's not a flaw in the strictest sense, but it is a sort of a shortcoming. Does anybody think websites remapping your basic hotkeys is a good idea?

When I posted this article, I considered changing the title because I agree that it is somewhat sensationalist and slightly misleading. I chose just to keep the actual article headline because I couldn't think of anything better at the moment. Would it have been better to change it? (I honestly don't know the HN norms)

Your OS/browser already identifies itself, so they know which look to fake.

The trick is to convince someone to try finding something sensitive on the page. This might be done by showing a long list of 'leaked' passwords or social-security-numbers.

Even without explicit prompting, some people might Ctrl-F search for their own, with a false confidence that a local search isn't shared with the page.

I'm not sure I understand you correctly, but the browser you are using can be ascertained with JavaScript or a server side script.

sorry, it was autocorrect, meant to type 'password' became 'browser'