Timeline for Is the Web browser status bar always trustable?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 3, 2013 at 5:49 | comment | added | curiousguy | "for browsers like Chrome where the address pop-up appears inside the page area" it seems that the Chrome designers did not bother with a reserved, separated, impossible to spoof status bar (such as the FF status bar if you disable JS changing of the status) because they did not believed the status bar had any security benefits. | |
| Sep 2, 2013 at 15:32 | comment | added | newuser999 | I accepted this as answer because Esailija's second example works without JavaScript :) | |
| Sep 2, 2013 at 15:32 | vote | accept | newuser999 | ||
| Sep 1, 2013 at 15:47 | vote | accept | newuser999 | ||
| Sep 1, 2013 at 15:56 | |||||
| Sep 1, 2013 at 12:22 | comment | added | Adi | @Esailija This is actually pretty neat. Thanks for posting it. | |
| Sep 1, 2013 at 11:52 | comment | added | Esailija | @Adnan Here is a working example: jsfiddle.net/48KFV/2/show it even works for middle-mouse click. jsfiddle.net/48KFV/2 to see the code (cannot run here because jsfiddle runs the page in iframe and there are x-frame-options deny) | |
| Aug 31, 2013 at 11:31 | comment | added | bobince |
@Adnan: still more trickery is possible. For example imagine a <form> set to post to URL A, with a hidden submit button (you don't get an address popup for this), with Esailija's CSS demo showing URL B.
|
|
| Aug 31, 2013 at 8:11 | comment | added | Adi |
@Esailija and bobince. While it's a nice example, you still need JavaScript to open the new window and "redirect" to the new evil URL. Moreover, the browser's original status "bar" has the highest order priority and will always lay on top of the one created with CSS et al, so using href won't help.
|
|
| Aug 30, 2013 at 14:27 | comment | added | Esailija | @MarcksThomas this should proove the point (test in Chrome): jsfiddle.net/48KFV/show I just didn't bother with the correct css and transition :D | |
| Aug 30, 2013 at 14:09 | comment | added | Marcks Thomas | @bobince: Can you provide an example? | |
| Aug 30, 2013 at 9:19 | comment | added | bobince |
Not really. You could still fake an address pop-up using only :hover CSS.
|
|
| Aug 30, 2013 at 9:04 | comment | added | Marcel | So, at least, if we have NO JavaScript, we should be safe, but not otherwise? | |
| Aug 30, 2013 at 8:35 | history | answered | bobince | CC BY-SA 3.0 |