Hacker News Reader

Comment by akersten | Hacker News Reader

What prevents a non-fullscreen site from just faking a keyboard with `position: fixed; bottom: 0;`? Really weird stance they're taking here. Kind of excludes an entire class of web applications (full screen games) from being usable on iPad, almost as if the real motivation is to drive you to the app store...

View on HN

What prevents them is that it'd be within the confines of a website, so url bar tells you you're on a website & not the appstore asking for permission

This gets into sandboxes needing to have "sacred pixels" as a border to prevent the sandbox tricking the user into thinking they exited from the browser

This issues goes way back: imagine if after executing a program on CLI instead of closing it gave you a fake shell, where you eventually went about your day until you had to type your password into sudo..

Of course, your point about the app store is good motivation to address this, whereas consoles don't go about offering much protection there

> , so url bar tells you you're on a website

Is this even the case anymore? On Android, all my URL bars peel up into the top of the screen as I browse, and I'm pretty sure a website can capture the vertical swipe/arrange an inner-scrolling element to make it very difficult to quickly get the URL bar visible again.

I think that would be enough to trick most users. This seems like an unnecessary limitation

This is iOS, though, where the URL bar is always at least minimally present.

On safari, but not on for example Edge for iOS or Chrome for iOS.

Is this security feature present on Edge or Chrome on iOS?

Huh. I’m surprised apple didn’t make it a requirement before approving those apps into their store given how strong their stance on privacy is.

> This issues goes way back: imagine if after executing a program on CLI instead of closing it gave you a fake shell, where you eventually went about your day until you had to type your password into sudo..

As a fun fact, even worse might be a program maliciously aliasing sudo in ~/.profile

That's a spooky one, although I've never heard of that happening in practice before.

But then again how, how someone know if that happened!

They'd have to know to look for it, but running `alias sudo` would show if it had an alias assigned to it. It would honestly be more effective to change $PATH to include the malicious version of sudo.

Which is a good reminder that password entry is terrible security wise. With macOS, you can sudo authenticate with your Apple Watch, which is really nice.

If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script.

For background, there is a convenience feature in sudo: It only requires your password prompt if you have not had a successful sudo invocation in the same terminal in the last X minutes (5 minutes, I think? not sure on the exact value). "sudo -v" is a special invocation which does not actually execute any command, but it renews your 5-minute lease. ("sudo true" is effectively equivalent, though not idiomatic.)

So if you're executing a short script that needs sudo, run "sudo -v" before running the actual script. Then you know that if a root password prompt pops up again, it's not really sudo who's asking.

> If you're concerned that a script's root password prompt may be a forgery, you can run "sudo -v" before executing the script.

The bigger problem is that even without sudo or your root password, malicious scripts can do a lot of damage. ie. they can add a fake sudo to your .profile, so you next time you try to do "sudo -v" your password still gets stolen.

Is this a feature built in into the OS? I have only heard of some third party code to allow that…

It's not built-in for sudo, which is surprising. It is however for many other authentication prompts.

On my phone, I use an obscure keyboard with a custom theme -- good luck faking that. Doesn't help your average user, though.

Fair enough. An attacker wouldn’t need to fake your keyboard though, it’s probably just enough to trick you into thinking you are entering sensitive information into a legit website while in reality it’s made to look that way but still using normal text inputs.

URL bar at the top, UI chrome is different in full screen vs windowed. (Full screen media playback on iOS has OS-level controls at the top.)

> almost as if the real motivation is to drive you to the app store...

Every "security" feature on Safari points into harming web apps so you are on the right tracks...

Reply on news.ycombinator.com