News for hackers. Stuff that matters.

A comment on How script kiddies can hijack your browser to steal your password. Parent comment

Re:How script kiddies can hijack your browser to steal your ... by InclinedPlane on Sunday December 02, 2012 @10:45PM (#4863837)
It's just social engineering, but done in a rather slick fashion. Normally one wouldn't expect that a password or credit card number or social security number would ever be typed into a search box for a web page.

Except, what if you posted a page of compromised passwords or other data? Then someone might go to that page and search for their own secret information, to see if it had been leaked. They wouldn't even think twice about this because normally the information in a search box is secure, and known only to the browser. But if a site creates an html based search box that is hooked into ctrl-F then the user might divulge their secret information without even knowing.

[ Parent | on HN ]
Re:How script kiddies can hijack your browser to steal your ... by hayksaakian on Sunday December 02, 2012 @11:01PM (#4863880)
That's my problem with the whole situation. The headline paints it as a technical flaw, where in reality it's human error.
[ Parent | on HN ]
Re:How script kiddies can hijack your browser to steal your ... by InclinedPlane on Monday December 03, 2012 @12:04AM (#4864042)
That's a very wrong way of thinking about the problem. It's not actually a human error except in the strictest sense. Imagine if the mechanism for flying an airplane involved a thousand different levers that all need to be carefully moved in concert in order to avoid crashing. Is crashing such an unflyable plane a "human error"?

The problem here is that browsers allow overiding ctrl-f and almost no users realize this is possible. It's not just a human problem, it's also a browser design problem. Browser makers have trained their users to trust that pressing ctrl-f will pull up a find dialog, it's as much their fault as it is user's fault.

[ Parent | on HN ]
Re:How script kiddies can hijack your browser to steal your ... by sliverstorm on Sunday December 02, 2012 @11:09PM (#4863905)
It's not a flaw in the strictest sense, but it is a sort of a shortcoming. Does anybody think websites remapping your basic hotkeys is a good idea?
[ Parent | on HN ]
Re:How script kiddies can hijack your browser to steal your ... by freditup on Monday December 03, 2012 @12:10AM (#4864060)
When I posted this article, I considered changing the title because I agree that it is somewhat sensationalist and slightly misleading. I chose just to keep the actual article headline because I couldn't think of anything better at the moment. Would it have been better to change it? (I honestly don't know the HN norms)
[ Parent | on HN ]