Hacker News Reader

Comment by gruez | Hacker News Reader

>All these sites use the same script that evades the popup blocker built into chrome yet none of google's 1000's of engineers can do anything about it apparently.

Because it's really hard to differentiate between legit popups (that the user wants) and popups that are unwanted.

https://en.wikipedia.org/wiki/Pop-up_ad#Pop-under_ads

View on HN

Why would anyone ever want a pop-under for any reason? I would be satisfied with a solution that turned any pop-under into a pop-up.

That's actually an interesting point. I wonder how many sites would be broken by disabling methods that shift window focus, like Window.focus() and Window.blur()? Probably not many...

Every bank website I've used so far does forced pop ups, as well as websites that want you to authenticate yourself using some other service (such as Google, or Facebook.)

Pop ups are reasonable. The pop unders are what google is saying are user unfriendly.

They might be, but the person I was replying to wanted to disable all methods that shift window focus. It won't work, at least as of right now.

When a window is created (with Window.open, or from a link with target="_blank"), it implicitly gets focus. That part wouldn't change.

> Every bank website I've used so far does forced pop ups

But why do they do this? I have yet to have someone give me a good explanation.

When it comes to web software at banks, there's rarely a good reason "why". They build some of the worst garbage you can find.

No idea. It just gets caught by the pop-up blocker for me. I end up just copy-pasting the URL over into a new tab, somehow.

It's done to escape from iFrame jail attempts. Rogue site loads bank site in iFrame, end user types in their password...

Browsers are not supposed to let javascript access the DOM or events in a cross-domain iframe, is that not correct?

Correct, but it's still possible for the parent page to overlay invisible textboxes and buttons in order to capture input.

Wow, what a tire fire the web has turned out to be.

Can we just throw the whole thing out and start over? I miss the 90s...

Isn't it easier to set X-Frame-Options to deny or sameorigin?

Yes, absolutely. But that didn't work on some older browsers (like MSIE7 and earlier), so some sites settled on weird "solutions" like this one...

Why not implement a good 2FA then to avoid the problem entirely? The way I see it if someone can steal your bank login details using iframes as a weapon then the bank is doing something wrong. Banning pop-ups entirely would force the banks to shape up

A lot of times you see self-closing popunders, which are almost always just poor design, but you might break a lot of old websites if you block pop unders.

I wonder if a good middle ground (restricting this without breaking legacy sites) would be to add a permission for this. By default any target=_blank or similar opens in the same tab, but it shows a permission or the 'pop-up blocked' notification, which allows the user to open it in a new tab, and grant permission for the site to do that by default. As a user you can still ctrl/cmd-click to force links (which are proper href links) to open in a new tab.

> Because it's really hard to differentiate between legit popups (that the user wants) and popups that are unwanted.

It really isn't -- does it exist? Yes? Then it's unwanted.

For the few misguided sites that use a pop-up as a ui element, the yellow '<site> has attempted to pop up a window' is sufficient.

There are zero cases where I'd be happier with a site opening a pop up window on my behalf, than doing it's thing in the same page.

They don't have to do that, and as another commerce mentions, often achieve this with otherwise perfectly acceptable api's - they make the link open a new tab, and then change the original site's content to an Ad.

Disallow opening new tabs. There are zero cases where I want a site to do that.

Really? I use Firefox with UBlock Origin and never see pop-unders. The only time I see them is when I use Chrome.

You have it for Chrome as well - https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

I never, ever want a pop-up. Let me block them all by default.

I have hard time imaginig a popup that the user wants.

Never clicked the "pop-out" button in Gmail or Hangouts?

No. What does it do?

Moves your chat or compose box into a new window. Useful for some people's workflows, less useful for others. I sometimes pop out a Hangouts chat so I can pin it somewhere I can see it while doing something else.

I find with things like this that it's a million times easier to have the feature turned off by default, and then whitelist your own specific use cases.

Thats what Ive done with Javascript on the web. My browsing experience is so much better without downloading 20mb of ad network code on every page load, that I could never go back even with the minor annoyance of having to click "allow javascript on this site" every now and then.

Reply on news.ycombinator.com