The Line of Death (2017)
a day ago
- #Browser Vulnerabilities
- #Spoofing Attacks
- #Security UI
- Security issue: attackers can control pixels to mimic trusted UI, tricking users into unsafe actions.
- Line of Death (LoD): browser vs. site control boundary, but it's not absolute or consistently indicated (e.g., chevron in Chrome).
- Zones of Death: attacker data can appear above LoD (e.g., icons, titles, domain names), making even trusted areas deceptive.
- Picture-in-picture attacks: entire browser windows, including trusted pixels, can be faked, challenging personalization as a defense.
- Fullscreen API and mobile UIs: exacerbate the problem by removing trustworthy pixels, making spoofing easier.
- PWA Window Controls Overlay: gives app authors near-full pixel control, raising risks, though with a high barrier to entry.
- Applications beyond browsers: also face LoD issues (e.g., email clients like Outlook.com with fake trusted sender notifications).
- User behavior: even experts can be tricked by fake UI, highlighting the difficulty of security UI design.
- Mitigations proposed: include persistent trust badges, image analysis, PetNames for site identity, and secure user gestures.
- Challenges: balancing usability and security, with solutions often being optimized away or insufficient.