Re: Geolocation spoofing and other UI woes

[Christian Sciberras <uuf6429 () gmail com>]

Pavel, did you actually check out the PoC?

It actually invalidates your idea as well!

These UI issues remind me of how MSIE made the security UI work for ActiveX,
where you get a topbar as well, but clicking it would shown up a popup
instead of allowing the activex.
As far as my mind goes, one can't exploit this since there is the concept of
requiring at least two clicks; if the first one was misinformed, the second
one surely can't be, besides, showing yet another overlay popup would
(should?) invalidate/hide the previous popup menu.

In reply to lcamtuf, the usability issues are crap, really. What is so
difficult in implementing a menu? The menu might have items saying "don't
ask again for this site" or "always allow for this site".

Cheers,
Chris.


On Fri, Aug 27, 2010 at 7:58 AM, Pavel Machek <pavel () ucw cz> wrote:

> Hi!
>
> > This may be of some interest to people on the list:
> >
> > http://lcamtuf.blogspot.com/2010/08/on-designing-uis-for-non-robots.html
> >
> > In general, there is a class of UI design problems that trace back to
> > the failure to account for the inherent limitations of human
> > cognition; the specific example exploited by this PoC is the HTML5
> > geolocation API (supported by most browsers except for Internet
> > Explorer); calls to navigator.geolocation.getCurrentPosition() result
> > in prompts that can be clicked in a timeframe shorter than the minimal
> > latency required to respond to visual stimuli. A whimsical
> > Firefox-specific PoC is:
> >
> > http://lcamtuf.coredump.cx/ffgeo2/
> >
> > I reported a number of flaws similar to this one between 2005 and 2007
> > (e.g., https://bugzilla.mozilla.org/show_bug.cgi?id=376473); but it
> > seems that these problems remain endemic to security UIs across all
> > browsers; and the previously implemented workarounds are sometimes
> > removed as a perceived usability roadblock. We probably need to do
> > better, especially as computers get faster; this would not have been
> > nearly as much of an issue ten years ago.
>
> Well, Android actually does something to address this for system
> prompts: dialog box pops up with buttons disabled, and they are
> re-enabled after second or so.
>
> This should be certainly done for security prompts, and probably for
> normal dialog boxes, too.
>                                                                Pavel
>
> --
> (english) http://www.livejournal.com/~pavelmachek<http://www.livejournal.com/%7Epavelmachek>
> (cesky, pictures)
> http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html<http://atrey.karlin.mff.cuni.cz/%7Epavel/picture/horses/blog.html>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/