I have noticed that it is possible to lag a browser sandbox very badly in some ways like making it deal with stack overflow (the condition not the site). Chrome can’t handle text files past a certain size and goes nutty. So if you put enough into frames maybe you could really stun it while a malware message shows.
An old trick many years ago was to fullscreen the browser displaying the scary message, then rapidly add to the end of the URL in the address bar until it eventually became so long that Chrome froze.
In the old days newspapers used to be fined for allowing fraudsters to take out ads in the classified section. Jail time wasn't out of the question either.
> The locker fills the screen, hides the cursor, swallows the usual exit keys, and lags the browser, all to manufacture the sense of a broken machine and pressure the person into calling the number on the screen. Nothing on the computer is actually locked, but in the moment it is convincing enough to push people toward the scam.
Tell me again why the browser has to be its own Turing-complete platform? Rather than a document reader as it was designed?
The more things change, the more they stay the same. This is the equivalent of 80s viruses having full control over the machine they run on, without any real mitigation outside of prevention.
Web apps were a mistake. So was always-on connectivity where any given program could connect to remote services in the background.
In fact, allowing computers to completely take over the world to the degree it has today was a mistake, at least as implemented by the tech overlords of the 90s and 2000s that built things to be the way it is now.
Really, this is just the continuing fallout from the dotcom bubble. A few companies vaulted to mega status, the rest died. And those remaining companies have destroyed the world slowly.
JavaScript itself would be fine as long as browsers didn't present certain capabilities to the running script. Modifying the DOM and rearranging elements? Go ham. Intercepting input and hard-forcing viewport sizes? Fuck outta here.
Edit: I've been getting the "slow down" thing on HN for the last couple of weeks after like five or six messages within a half hour. Not connected to HN through any VPN or obfuscation. It's annoying because it seems to take a solid hour or two (haven't measured) to unlock.
When I saw the WebGPU “Deathray” published for macOS browsers earlier this month, my first question was how long until something similar would be used for phishing.
Ironically I couldn't read the article due to the deluge of ads
3 years ago, https://www.reddit.com/r/technology/comments/1af21z2/ars_tec...
I have noticed that it is possible to lag a browser sandbox very badly in some ways like making it deal with stack overflow (the condition not the site). Chrome can’t handle text files past a certain size and goes nutty. So if you put enough into frames maybe you could really stun it while a malware message shows.
An old trick many years ago was to fullscreen the browser displaying the scary message, then rapidly add to the end of the URL in the address bar until it eventually became so long that Chrome froze.
My mother had this same thing, closed her laptop in a panic and it was gone when she restarted
In the old days newspapers used to be fined for allowing fraudsters to take out ads in the classified section. Jail time wasn't out of the question either.
Once again reality reminds us that ad blocking is personal infosec.
> The locker fills the screen, hides the cursor, swallows the usual exit keys, and lags the browser, all to manufacture the sense of a broken machine and pressure the person into calling the number on the screen. Nothing on the computer is actually locked, but in the moment it is convincing enough to push people toward the scam.
Tell me again why the browser has to be its own Turing-complete platform? Rather than a document reader as it was designed?
The more things change, the more they stay the same. This is the equivalent of 80s viruses having full control over the machine they run on, without any real mitigation outside of prevention.
Web apps were a mistake. So was always-on connectivity where any given program could connect to remote services in the background.
In fact, allowing computers to completely take over the world to the degree it has today was a mistake, at least as implemented by the tech overlords of the 90s and 2000s that built things to be the way it is now.
Really, this is just the continuing fallout from the dotcom bubble. A few companies vaulted to mega status, the rest died. And those remaining companies have destroyed the world slowly.
Hence my multi-decade long zeal to ban JavaScript ... in web browser.
JavaScript itself would be fine as long as browsers didn't present certain capabilities to the running script. Modifying the DOM and rearranging elements? Go ham. Intercepting input and hard-forcing viewport sizes? Fuck outta here.
Edit: I've been getting the "slow down" thing on HN for the last couple of weeks after like five or six messages within a half hour. Not connected to HN through any VPN or obfuscation. It's annoying because it seems to take a solid hour or two (haven't measured) to unlock.
When I saw the WebGPU “Deathray” published for macOS browsers earlier this month, my first question was how long until something similar would be used for phishing.
https://auberon.xyz/blog/posts/deathray/ Discussion: https://news.ycombinator.com/item?id=49649124