Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

One of the worst ones is those malicious "your computer has been infected" ads, that web browsers allow to disable to close tab buttons with message box windows and such. Users get frustrated, and give up and call the phone number, pay the $250, etc.

It's very hard for me to convince people that:

A. More than likely anything you do before you call me, is going to make it worse.

B. You can always just shut off your PC.

View on HN

This is one of the many reasons that script blockers (which are another opportunity for security fatigue) are something I frequently recommend friends, relatives, and co-workers use.

I believe this is a poor solution, because the problem is simply with web browser design. Website-initiated popups should remain inside the browser tab, and the browser tab should always be closable. There is NO excuse for a web browser to allow a website to, even temporarily, disable it's UI, particularly the UI to close it. Scripting that controls your browser should not be allowed. Nontechnical users need to be able to trust their browser UI. Message boxes that look like OS prompts should simply not be available options for websites to use.

What about full screen video?

They explicitly ask for permission for that and you can press escape at any time to leave.

Seems reasonable.

Exactly, control of the browser is never really ceded. And any act of fullscreen tells the user how to undo it on pretty much every browser.

I've never seen a webpage disable the "close tab" button. Are you sure your computer isn't already infected?

Then you haven't seen aggressive enough scripts. It's certainly possible using perfectly standard usage of web standards to cause a denial of service attack to most browsers in that way.

Have you ever gotten a popup message box in a web browser before? Pretty much all web browsers support them, and you can't click on any browser UI until you address the prompt.

...and then the web page can pop up another alert before you have time to do anything else.

    for (;;) alert("spam!");

Chrome will, at least, give you an option to disable the alerts if it thinks you're getting them too often, but by that point you're well into scary territory.

Footnote: just tried it in Chrome, and after disabling popups I got a tab which was spinning using 100% CPU and which was completely uninteractive. I couldn't even close it using the x on the tab and I had to kill it via the Chrome task manager. Hmmm...

There was a time when using vimperator with firefox you'd always be able to focus the command prompt and enter a command like :q to close the tab, even if there's an active alert popup on the screen.

It's hilarious to me that this thing is still a problem when it's technically trivial to solve.

Actually I don't know if the feature was due to vimperator, firefox, or just my window manager.

I have no idea what you're talking about. I tried it and after the first popup there's a checkbox to disable any more popups. It didn't affect any of my other tabs and I could kill the process of that one tab through task manager.

Chrome (and I assume others) put a checkbox to prevent the webpage from opening to popups in the popups if a site does it to often.

Edge does it as well, but I advise people not to click buttons on malicious webpages. So the fact that you have to click the button on the malicious webpage several times to get the option to disable it is very irritating.

Huh, they haven't worked that way in Firefox for ages. Just tested in Chrome and Edge and they both have that problem though.

Safari also traps alert()s inside the tab and you're free to use all of the browser chrome.

Doing a new pop-under tab in the onclose-handler seems to work pretty ok.

Reply on news.ycombinator.com