https://onlineaspect.com/2014/06/06/clickjacking-amazon-com/
Sure, maybe the attacker can abuse the access privileges before you have a chance to revoke them. But it’s not exactly a smooth clickjacking.
I’d start by changing the dimensions of the parent window (prior to redirecting to victim) to the size of the button on the target page - no need to show everything around it (assuming you can make it scroll to the right place). And if the OAuth redirects to the attacker page, it can restore the size to the original.
Back in the day, this trick was used for clickjacking Digg upvotes.
Actually the double-click action is pretty rare nowadays, right? In particular, I use it a lot to select a word in a terminal, but most of the time when I am getting UI instructions it is from a website about how to use the website itself, and since that’s a website it has to be abstract enough to also make sense for mobile users.
Telling people to double click is, I think, mostly dead.
- The page mostly loads
- An ad starts playing
- I attempt to hit "pause" while I go handle a thing or two [0]
- As I'm about to click "pause", the layout shifts to the left exactly enough for me to unmute the ad
- I immediately click again to stop listening to whatever scam is currently being peddled
[0] For some videos I like to read the description before watching. For all videos I like to make it as obvious as possible to Google that there isn't a real person watching the ad (browser not focused, ad muted, ...).
Entirely separate, a common failure mode of dying mice is that they start generating spurious clicks. I've had a couple of logitechs do this to me. And the thing about scams is you can often legit make money off of very low success rates.
Speaking of things dying out, it's been so long since I used anything but a trackpad that I thought at first this was some strange claim about rodents!
Not sure this would work with the exploit though.
it pisses me off
So I'd try adding a small timeout when the tab is visible:
document.addEventListener("visibilitychange", () => {
if (!document.hidden)
setTimeout(enableButtons, 200)
})Related XKCD: https://www.explainxkcd.com/wiki/index.php/2415:_Allow_Captc...
When I watched the Salesforce video, the exploit was demonstrated by pointing the browser at a file on disk, not on a public website. I also don't understand the "proof," IE, something showed up in the salesforce inbox, but I don't understand how that shows that the user was hacked. It appears to be an automated email from an identity provider.
I also don't understand when the popup is shown, and what the element is when the popup is closed.
Some slow-mo with highlighting on the fake window, and the "proof of exploit," might make this easier to understand and demonstrate
If I were running some site where pressing a button does some kind of auth that I really want a user to read, that seems like a reasonable mitigation compared to the hyperbole found in the article:
> This technique seemingly affects almost every website
// SmoothScroll for websites v1.2.1
CAPTCHA:
Please copy `qwertyuiopasdfhkl`
Into here `<textbox>`
Edit: Quick (ai mockup) concept... https://imgur.com/mc0IdEA Obviously it would be most effective with a longer string though.
Edit: Actually that's generally I guess triple click. Double to select a word.
Having a mental model of "this button needs to be double clicked" gets them the result they want, even if that's not a very accurate reflection of the computer.
In practice: adherence to this ranges from perfect to abysmal. And users who don’t understand the computer well may not know how to think about whether a given UI element is selectable or not.
So, the rule:
List of files on your computer or desktop? Double-click. Otherwise? Don't.
Although seriously, I find I never break out of the preview in Outlook email. The only spot in Outlook where I really need to double-click is the calendar. Which is annoying.
You've never had a slow internet connection have you? I've seen double clicking from all users in the office. Comes from frustration.
How many times have you tried to open an application; for it not open? So you click the icon again only for two windows to split open?
Young, old, even techs. It's not as uncommon as you think.