I recorded user behaviour on my competitor’s websites (2018)
dejanmarketing.com
dejanmarketing.com
Examples of press on topic:
https://valleywag.gawker.com/how-a-hacker-intercepted-fbi-an...
https://www.theverge.com/2014/2/28/5458610/fake-google-maps-...
Shady tactics aside, this was interesting but could also have been measured by simply tracking his own website.
Perhaps his competitors were established, trusted brands, whereas his is one that hijacks back-buttons to trick his own customers.
A fool with a tool is still a fool.
Presumably, this is in pursuit of making web pages behave more like apps, but it is truly frustrating. If I wanted app behavior, I'd install an app (even something like Chrome's apps). While I'm in a web browser on a web page, I expect to interact with the web browser primarily and the web page through the browser intermediary.
The Line of Death discussion is highly relevant: https://news.ycombinator.com/item?id=13400291
Disclaimer: I work for Figma.
I work for a company that uses Figma and I haven’t seen anyone use the desktop app. I didn’t even know there was one.
Im not parent, but given a choice between native app & web app, I'd take the browser. That it's possible at all to have parity is amazing
I'm not sure the benefits of allowing the Figmas of this world to offer a good app experience outweigh the costs of putting the same tools in the hands of every shitty news site.
As another commenter mentions, I'm more likely to disable Javascript by default rather than continue to allow it's abuse. I suspect I'm in the minority though.
Double-redirect attacks not withstanding...
There’s nothing that infuriates me more than trying to read an article and suddenly being forced to either spam the back button or close the tab entirely.
Agreed on how infuriating this is though!
If you double-right-click (huh) you can see the "normal" menu. If you use Firefox you can shift-right-click also.
Ever letting Javascript initiate requests on its own was a mistake, to pick one major blunder.
It is an utterly fascinating takedown of the back button hijack. Totally unethical but also very eye-opening for me.
Is this kind of back button hijack and history rewriting still possible in modern browsers? Edit: this link leads me to believe this may still be possible: https://developer.mozilla.org/en-US/docs/Web/API/History - would love a confirmation.
here is where i am coming from:
1. the end user is on a google search engine results page (SERP) and sees the blog post author's website as one of the search results
2. the end user clicks the link to the blog post author's website
3. the end user is now on the blog post author's website
4. the end user hits the back button
- i believe the end user has a reasonable expectation that they will be back on the google search engine results page... but *they are not*. they are on a mockup that looks like the google SERP but is in fact controlled by the blog post author.
i believe this is highly unethical! they are fooling an unsuspecting end-user into thinking they are visiting a brand new site, but they most definitely are not doing so. ultimately, i think that google and other browser authors should remove the possibility for this sort of trickery. i do admire the blog post author for posting the social engineering/programming trickery while still viewing it as unethical.
edit: at the bottom of the blog post the author links this previous HN comment which i find interesting: https://news.ycombinator.com/item?id=17826106 - and this one is as well https://news.ycombinator.com/item?id=17823886#17826206
If this were early days of the web, I'd agree, but web browsers allow so many other shady tactics, this feels more like the web working as intended.
(Yes, phishing attacks are bad, but the browser back button spec is specifically designed to allow these sorts of shenanigans, with basically zero legitimate use cases -- the only use case I can think of is telling the browser certain actions should not push themselves onto the back button stack).
I agree on the "legitimate" part, but I suspect one of the main reasons is that Google and Apple both really want people to be creating SPAs that pretend to be real apps, and that's hard to do without being able to hijack the back button for navigation.
I also assumed most people did this.
Yes, this is one of the best parts of having a desktop + mouse compared to a laptop + trackpad (or nub).
Yes, and firefox configured to open windows, not tabs (!) Call me a luddite if you like but ctl-w and alt-tab are always to hand and better than any amount of new-fangled tabby nonsense IMNSHO...
Never thought of it as relevant to security before though.
It would group your tabs together. No chance of accidentally pressing the wrong shortcut in the wrong window (even if it only happens rarely).
Just like there’s a lot of people who would never send money to a prince from Africa. A lot of people will…
OTOH, sometimes a harmless PoC isn't enough to induce action, and a proper attack PoC does. I think this may be such a case.
It's all a moot point, because you can reproduce this particular attach using nothing but 2001-era DHTML. Start with a page that has a hidden iframe, a link that targets it, and a timer that polls the contents of the iframe. When the page first loads, use JS to click the link to add a new item to the back stack. If clicking the link with JavaScript doesn't add a back stack item, make the link visible, but also attach an onclick event handler to it so that the link can simultaneously do what you want and also do what the victim wants.
After you've poisoned the back stack, you can detect that the user clicked "back" when the iframe gets reset back to its initial page. Once this is done, use `document.body.innerHTML = whatever` to set up your fake SERP.
The "attack" I'm thinking of is hijacking the back button, but done using iframes instead of history.pushState. It doesn't involve any third-party origins, so x-frame-options doesn't matter, because a domain owner that wants to launch this attack has control of all the HTTP headers.
I always find it funny how these hackers grasp for some othered group that they can justify mistreating. If you're gonna be a hacker stop pretending that you're a moral being and accept what you are
This is a really tricky one to solve because the protection that is intended to guard against it ("The user is aware the current domain they are accessing doesn't match the site they expect it to match") isn't working. I think that aspect is the larger problem... IRL, people know if they're standing in a Target vs. a used car dealership, but they rarely know if they're at target.com instead of target.used-car-dealership.com.
It's possible the browser's framing should be changed to make it harder to be confused about that (color-and-texture-hash the TLD and apply it to the URL bar as a background, so there's a major visual difference if I'm on the wrong site?).
Why should I care about that? If you have to break the browser for your app to work, maybe you should be doing a desktop/mobile app instead.
And a significant portion of business users will be in desktop browsers with restricted permissions, so they can't install an app
If you have some "thing", that is so grotesque that it needs to break a users web browser in order to work correctly, you no longer have a "site". You have a creature, you have an application. Some people would step back at that point and maybe think about the path they are going down. Others would trundle forward, oblivious to the fact that they are hammering a square shaped JavaScript peg into a round hole.
The simple dynamically-linked page displaying application you are imagining a browser to be is long dead, in much the same way the simple programmable calculating machine that was the personal computer was long dead by the time John Carmack got it to run Doom.
There is nothing "grotesque" about writing web applications.
That is the entire point of HTML5 + CSS3 + AJAX.
With modern Chrome-based browsers and Firefox I can write an application that can be used by Windows, Mac, Linux, BSD, iPhone and Android users who need only visit that site.
No installation necessary, and (most importantly) no gatekeeping of apps by Apple, Google or Microsoft.
This is kind of misleading, as you need to install a browser for it to work. Granted, most computers already have that, but the browser is acting as a "runtime" in this situation. Contrast with other programming languages such as Go or Rust, that produce a single executable that can be dropped in a folder and ran.
Because they are major use-cases for the web browser framework. I mean, that's a bit like asking why you should care about Web Audio API, or the accessibility layer... The fact you're not using it doesn't mean it isn't vital for those who do.
Nope. Those are both useful elements of a browser, that don't even require JavaScript to use. What you're talking about is the monster/frankenstein that is web applications.
For example: for performance reasons, many web apps are logically divided into sections. Navigating between sections doesn't unload the current page, it retains it and context-switches to another page. This is done for several reasons (the main ones being performance and flicker-stoppage, so users aren't hit with a screen-blank navigating from one section to another). This trick is often accompliahed by being very creative with the routing so the user's experience is as if they are navigating around to different pages on a site (while in reality, a page navigation never occurs). console.cloud.google.com is an example of a site that works this way. AWS console does too; look closely while navigating around AWS and one will observe that the URL looks like https://us-east-2.console.aws.amazon.com/cloudformation/home..., i.e. the sub-panel is encoded locally in the fragment instead of up in the resource name, and going from subpanel to subpanel changes the fragment and pushes entries into history.
... but to get that seamless behavior, it has to inject history entries so that the back button takes the user to a previous logical page, not a previous URL the browser requested. Writing the app will be more complicated if the back button navigates the user entirely off of console.cloud.google.com instead of taking them to the previous pane they had open.
People always say that, yet every time I encounter an app that doesn't use JS navigation, it always feels faster and smoother...
And as for them being bigger and clunkier, in almost all cases I've experienced, the frontend code is by far the clunkier and bigger of the two. But maybe it's because I use Ruby and other backend languages are less generous in their accommodations.
> The hard-coded behavior of the browser doesn't always match the user's concept of what has happened when performance optimizations are added in.
Eliminating JS navigation doesn't mean eliminating JS. You'd still be asynchronously modifying backend state and browser state on a single page, you're just not using it to change pages.
> For example: for performance reasons, many web apps are logically divided into sections. Navigating between sections doesn't unload the current page, it retains it and context-switches to another page. This is done for several reasons (the main ones being performance and flicker-stoppage, so users aren't hit with a screen-blank navigating from one section to another). This trick is often accompliahed by being very creative with the routing so the user's experience is as if they are navigating around to different pages on a site (while in reality, a page navigation never occurs). console.cloud.google.com is an example of a site that works this way. AWS console does too; look closely while navigating around AWS and one will observe that the URL looks like https://us-east-2.console.aws.amazon.com/cloudformation/home..., i.e. the sub-panel is encoded locally in the fragment instead of up in the resource name, and going from subpanel to subpanel changes the fragment and pushes entries into history.
Do you have a study that demonstrates the impact of this website organization with JS navigation and without JS navigation? There's a lot of talk about this being more performant and eliminating flicker, but are those real problems? Does HN flicker for you when you move across pages? I've heard these reasons a hundred times, but rarely see evidence that they hold up under scrutiny. Usually it's an after-the-fact justification rather than an upfront necessity.
> Writing the app will be more complicated if the back button navigates the user entirely off of console.cloud.google.com instead of taking them to the previous pane they had open.
I feel like this answer is almost intentionally forgetting that URI paths exist without JS. Am I missing something in your answer that explains why they are insufficient?
Yes.
- navigating to a new page triggers a page reload
- a page reload tears down the page context
- the new page must be loaded from scratch, a new context set up, JavaScript started from scratch, and the page parsed and executed
Even if the resources between the two pages are shared and those shared resources properly cached, time is lost relative to the more instantaneous process of making partial edits to an already loaded page and only loading the JavaScript necessary to pull in features that weren't on the page navigated away from.
I recommend popping the browser inspector open when using AWS console or Google Cloud console and look at what's going over the wire. As the user navigates around, these web apps are only loading the chunks of the interface necessary, not the Chrome or the sidebar or any of those other already-loaded components. Those components are already live in the JavaScript context and don't need to be rebuilt from scratch because they weren't destroyed, since no page navigation occurred.
You can make the case that those consoles are over complicated and could be replaced with a handful of web forms (not by comparing them to hacker news, the relative complexity of the pages are apples to oranges... If I were to make the case, I would make it by saying that the Google app engine console that predated Google Cloud console was perfectly serviceable, clunky and slow as it was). But given that they are what they are, the dynamic loading is much faster than tearing down and building new pages as a user navigates around the panels in the console.
And given the way they work, the user expects the back button to go to the previous panel, not to navigate completely out of the web app because they happened to enter the experience from a specific URL.
Technically, yes. Whether it's significant difference is reflective of the engineering, and sometimes, on the product design.
And the beauty of not using JS navigation is that you don't need to draw the page using JS templates. The dynamic data, sure, but the rest can load pretty instantaneously.
Out of curiosity, when's the last time you built a web app that doesn't rely on JS navigation, and architected it with that in mind? What was that experience like, and how does it compare to your JS experiences?
But even if the server is doing a lot of heavy lifting, the end user experience can benefit both in performance and bandwidth from minimizing page reloads. There's some pretty spiffy client and server template technologies now that let you get pretty close to write once, render on either the client or the server depending on which is cheaper.
And there are other applications for which manipulating history is a better fit. Otherwise, how would you mail history into a web experience that doesn't match very well to page navigation at all, like a WebVR walk where you want to be able to return to a location via URL, or a music player where you want the history to go back and forth between the songs you played?
It's nice to be able to hit back to close it, especially on phone browsers. And it's also nice to stay on the same page context the entire time, so it can respond much faster and doesn't screw up the scrolling.
Add manual penalties for the ones that slip through the automated testing.
Once it becomes known that doing this means saying bye-bye to your traffic, sites will stop doing it.
Secondly: that's already a bad user experience in contrast to just unifying the behavior behind one button. Why did the user have to discover that a button doesn't work the way they expect? Why are they going to have to remember it doesn't work the right way now? And they'll have to repeat that experience for every web app they use? That's a mess.
[1] https://www.nngroup.com/articles/ux-writing-study-guide/
P.S. Yet it is not like "serious businesses" do not partake in fraud: Enron, cough cough some/most banks(creating of unauthorized accounts, mortgage fraud, investor fraud, etc).