How script kiddies can hijack your browser to steal your password

Which would also be the same class of user more likely to change their password after being notified of a mass password leak.

I'm confused as well, but the only time I can imagine doing that is when there's a big leak of passwords (like LinkedIn a while back) and I want to check if my password is among those leaked.

I've actually seen links on hackernews that go to these big data dumps of information. Presumably, you'd check to see if your info was leaked using the browser's find mechanism. A clever enhancement is that as you type, JS on the page actually inserts whatever you're typing into the content of the page. So you won't ever just type the first few characters of your password and see it's not there, you'll always find your info or similar info on the page.

I agree that it does seem a touch unlikely to work in the real world. However, I think a scammer with a touch of ingenuity, creativity, and programming knowledge could probably construct a realistic enough scenario to fool many people.

Look at the example pages.

Because the exploit pages are lists of leaked passwords, or cc#s. So to check if their password has been leaked they would naturally search for their password.

This is just a very slick implementation of the old "enter your credit card number to see if it's been stolen" technique, except the end-users don't realize that they've given anything away.

Here's an analogy: you get a phone call from someone telling you that your bank account has been hijacked and you need to visit your local branch right away to fix it. So you drive to your bank, enter, and you go talk to a bank employee. As he sits at a computer he asks you for your bank account number, home address, and social security number. After typing them in and hitting a few buttons he tells you that your account has actually not been hijacked and you're safe, so you head home and go watch tv. Meanwhile, what actually happened is that you didn't realize that it was a bank holiday and con-men had broken into the bank and dressed up as bank employees to trick you into giving out your personal information.

> There is a special place in hell for people who override [...] the arrow keys in their webpages.

Except for game developers, maps developers, in-browser document editors, presentation viewers, etc. The web isn't just hypertext any more, and part of making the browser a powerful platform is having features that could be misused.

    Do any major browsers have a setting to disable overriding default keyboard shortcuts

I don't know about that. When I'm using a web-based word processor or spreadsheet I want CMD+s to save the document I'm working on instead of bringing up the "Save Web Page As" dialog....

I don't think i'll ever fully understand this approach. Most of the web is simply broken without javascript.

I'm not sure I understand you correctly, but the browser you are using can be ascertained with JavaScript or a server side script.

Your OS/browser already identifies itself, so they know which look to fake.

The trick is to convince someone to try finding something sensitive on the page. This might be done by showing a long list of 'leaked' passwords or social-security-numbers.

Even without explicit prompting, some people might Ctrl-F search for their own, with a false confidence that a local search isn't shared with the page.

It's just social engineering, but done in a rather slick fashion. Normally one wouldn't expect that a password or credit card number or social security number would ever be typed into a search box for a web page.

Except, what if you posted a page of compromised passwords or other data? Then someone might go to that page and search for their own secret information, to see if it had been leaked. They wouldn't even think twice about this because normally the information in a search box is secure, and known only to the browser. But if a site creates an html based search box that is hooked into ctrl-F then the user might divulge their secret information without even knowing.