full-disclosure - Re: Geolocation spoofing and other UI woes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=aOfWGCTbRL5z=uGH7mXdt-g4HAXuGzWdLDHNj@mail.gmail.com>
Date: Fri, 27 Aug 2010 14:40:58 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: Pavel Machek <pavel@....cz>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Geolocation spoofing and other UI woes

Pavel, did you actually check out the PoC?

It actually invalidates your idea as well!

These UI issues remind me of how MSIE made the security UI work for ActiveX,
where you get a topbar as well, but clicking it would shown up a popup
instead of allowing the activex.
As far as my mind goes, one can't exploit this since there is the concept of
requiring at least two clicks; if the first one was misinformed, the second
one surely can't be, besides, showing yet another overlay popup would
(should?) invalidate/hide the previous popup menu.

In reply to lcamtuf, the usability issues are crap, really. What is so
difficult in implementing a menu? The menu might have items saying "don't
ask again for this site" or "always allow for this site".

Cheers,
Chris.


On Fri, Aug 27, 2010 at 7:58 AM, Pavel Machek <pavel@....cz> wrote:

> Hi!
>
> > This may be of some interest to people on the list:
> >
> > http://lcamtuf.blogspot.com/2010/08/on-designing-uis-for-non-robots.html
> >
> > In general, there is a class of UI design problems that trace back to
> > the failure to account for the inherent limitations of human
> > cognition; the specific example exploited by this PoC is the HTML5
> > geolocation API (supported by most browsers except for Internet
> > Explorer); calls to navigator.geolocation.getCurrentPosition() result
> > in prompts that can be clicked in a timeframe shorter than the minimal
> > latency required to respond to visual stimuli. A whimsical
> > Firefox-specific PoC is:
> >
> > http://lcamtuf.coredump.cx/ffgeo2/
> >
> > I reported a number of flaws similar to this one between 2005 and 2007
> > (e.g., https://bugzilla.mozilla.org/show_bug.cgi?id=376473); but it
> > seems that these problems remain endemic to security UIs across all
> > browsers; and the previously implemented workarounds are sometimes
> > removed as a perceived usability roadblock. We probably need to do
> > better, especially as computers get faster; this would not have been
> > nearly as much of an issue ten years ago.
>
> Well, Android actually does something to address this for system
> prompts: dialog box pops up with buttons disabled, and they are
> re-enabled after second or so.
>
> This should be certainly done for security prompts, and probably for
> normal dialog boxes, too.
>                                                                Pavel
>
> --
> (english) http://www.livejournal.com/~pavelmachek<http://www.livejournal.com/%7Epavelmachek>
> (cesky, pictures)
> http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html<http://atrey.karlin.mff.cuni.cz/%7Epavel/picture/horses/blog.html>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/