Hacker News Reader

Comment by notriddle | Hacker News Reader

Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?).

Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.

View on HN

That problem is easily solved. In your malware, simply use the default settings for all of those things, and you will catch the 97% of users who never customize any of it.

You can afford to lose the remaining 3%.

It's also a bit self selecting - there's a lower chance those that change the defaults will fall for these attacks anyway.

The title bar thing, yes.

The accent color? If you buy a new Windows 10 machine off the shelf, after you enter your name, it asks what your favorite color is. I think blue is highlighted when that screen comes up, but you can't miss the opportunity, so 3% is a bit low for an estimate of how many people will change it.

Favourite colors don't follow a random distribution. IIRC with blue and green you already have two thirds of the population.

A browser ad that imitates a windows dialog can only guess one color per impression. Forcing Mallory to settle for 1/3 of the otherwise-vulnerable population is a definite improvement.

CSS System Colors support[1] in Windows/IE makes this harder to stop than you many realize. I don't see it very much anymore, but when it first came out, I saw quite a bit of this.

[1]: http://www.w3.org/TR/css3-color/#css2-system

Reply on news.ycombinator.com