256

When I click to download a file through Firefox, a dialog window appears asking me whether I want to save the file somewhere or open it immediately once downloaded.

Screenshot of a Firefox download dialog

The OK button in the dialog window starts disabled, and doesn't enable until the dialog has had focus for around a second. The dialog isn't modal, and if I focus on another window the OK button will disable and again won't re-enable until the window has held focus for a second.

My partner lamented at this design, and asked me why she couldn't just click OK to download immediately - I responded that I've always thought it was a security feature. Now that I think about it however, I'm not certain exactly what behavior it could be preventing. I would have thought that it might prevent some malicious website from downloading a file secretly by forcing the download window to stay open for at least long enough to see whats going on - however it should be possible for a site to download stuff secretly in the background anyway. Regardless I presume most users would have clicked the 'do this automatically from now on' box at some point, and thus be unprotected anyway...

So, is this a security feature? If so what does it protect against?

Improve this question
2
  • I kinda thought it was probably some strange piece of slowness caused by inefficiency by whoever developed the specific code by Firefox. If Firefox had it clear that the delay was intentional, such as changing the value of the button to say "OK in 3..." and show a countdown, then at least I would have understood that this was clearly intentional behavior.
    – TOOGAM
    Commented Mar 26, 2016 at 16:09
  • 6
    yes, supposed to enhance security but can be turned of by setting security.dialog_enable_delay = 0 [ superuser.com/questions/1023643/… ]
    – eMPee584
    Commented Jul 16, 2018 at 10:15

5 Answers 5

Reset to default
362

Yes, it is a security feature, and the purpose of the delay is to prevent attacks based around tricking the user into entering input to skip past the dialog by popping it up unexpectedly when the user is in the middle of inputting multiple key presses or mouse clicks in quick succession. The two examples that are given in this blog post explaining the feature are:

  • A CAPTCHA that asks the user to type the word only. When they press n, a save dialog is popped up, and then the user will immediately press l and then y, which is the keyboard shortcut for OK on some browsers, unintentionally confirming the download
  • A webpage that convinces the user to double-click somewhere on screen, positioned so that when the dialog opens after the first click, their mouse pointer is right over the "OK" button, meaning that they immediately confirm it.

By disabling the button for several seconds, the input has no effect.

Mozilla bug report about the issue

Improve this answer
22
  • 20
    Also user can use extra time to actually check file name/type. Without ad-block you can accidentally download some evil .exe instead of actual content. I have not experienced input trick myself yet, but from time to time I delete "evil toolbar [32].exe" from my download folder ;)
    – PTwr
    Commented Mar 21, 2016 at 9:21
  • 12
    I'm finally enlightened.
    – Aloha
    Commented Mar 21, 2016 at 11:55
  • 89
    This an excellent answer and I just want to further add that users can also become numb to pop-up messages and confirmations. I would imagine that this slight delay can help mitigate those that have become numb. Anecdote: I was showing my dad how to use the web browser on an Android phone recently and some pop-up appeared and he hastily clicked OK; without a moment to spare he turns to me and asks "What did that say?". I am 95% confident that it had something to do with an expired SSL cert but we shall never know for certain.
    – MonkeyZeus
    Commented Mar 21, 2016 at 15:52
  • 5
    @MonkeyZeus That's pretty interesting behaviour. Did you ask why he clicked before reading it, since he apparently wanted to know what it was?
    – pipe
    Commented Mar 21, 2016 at 18:00
  • 21
    @pipe I may have inadvertently provoked his question "What did that say?" because I'm sure I gasped or muttered "wait" under my breath. Nevertheless, I think it still demonstrates the pop-up numbness.
    – MonkeyZeus
    Commented Mar 21, 2016 at 18:31
16

Let's imagine that there's no delay, the default action for executable files is to open it, and there's some delay before the page requests the file download. In theory, you could accidentally run a virus if you were typing something at the exact time the dialog popped up. Incredibly rare, but I'm sure it's happened to someone somewhere.

Less maliciously, from a user experience standpoint, the user might be in the middle of pressing space or Enter right when the dialog pops up, therefore accepting the default, and possibly incorrect, action. The short delay prevents the user from accidentally selecting the wrong option.

While I doubt this feature was actually meant to protect anything (I'd rather trust my antivirus to that task), I find that I'm less likely to accidentally do the wrong thing with the file when the UI flushes my input and makes sure I actually meant to perform some action.

Improve this answer
3
  • 7
    Firefox never executes an exe file, at least not from that dialog.
    – David Balažic
    Commented Mar 21, 2016 at 15:48
  • 1
    It's only happened to me once that I can recall, but I definitely had a dialog appear once as I was typing, with exactly the right timing to catch my spacebar. I have no idea what it said.
    – Dan Henderson
    Commented Mar 23, 2016 at 21:35
  • 1
    "I'd rather trust my antivirus to that task" - I'd sooner try to avoid the problem occurring in the first place than rely on antivirus to clean up afterwards. (In other words, I would prefer a UI that helps to avoid drive-by-downloads than one that lets them happen and relies on antivirus software to stop them from doing any damage.)
    – micheal65536
    Commented Mar 27, 2016 at 11:49
12

There is one thing that none of the other answers have mentioned: many users click OK and download without reading the popup window.

If a user were to download a malicious file accidentally (or was tricked into doing so), and clicks OK on instinct without reading and checking the file they are downloading, then they could miss important security information such as the size, filetype extension and location of the file about to be downloaded.

By disabling the OK for a few seconds, Firefox forces users to think twice and check what they are downloading.

Improve this answer
6
  • 5
    Do you have any proof or is it just a pure guess that disabling the button for a few seconds makes users read the message? I am asking because there are dialogs intended to force users to read the contents like approving invalid certificate or agreeing to a license agreement. They use methods other than delay.
    – techraf
    Commented Mar 22, 2016 at 6:46
  • @techraf I do not have any proof (as in research papers etc) however from my own experience (I used to click OK all the time until I started using FF) and watching other FF first-timers (they do seem to actually read the popup after their first click) I can confirm that it does work. Note that one of the answers in the question that MonkeyZeus linked to (under the accepted answer) states that breaking the flow of an application by introducing a delay or an additional step does make the user read.
    – angussidney
    Commented Mar 22, 2016 at 7:20
  • @techraf, What is the user to do in that second of delay... They will be looking at the dialog, and their brain will visualise the words, which may proceed to their consciousness sufficiently that they find themselves 'reading' some part of it. Or they could screw their eyes shut to be deliberately obtuse ;-) As long as the delay is sufficient to make the user 'sigh', and then click in a considered manner it's an improvement (in my risk/reward trade-off view).
    – Philip Oakley
    Commented Mar 25, 2016 at 12:45
  • @PhilipOakley Do you have any a reference to research results?
    – techraf
    Commented Mar 25, 2016 at 12:49
  • @techraf, unfortunately I don't have any specific references. Though there is lots of commentary about 'Lucky' people studies that show those with 'eyes open' (i.e. a wider view) and more lucky. As with most of these studies they are 'tricks'. You are asked one thing while they study another, e.g. read paper to see how often a sports person is mentioned but actually see if they notice the 'free money if you tell the researcher advert'!. Plus, the opposite postulate (screw up eyes) is clearly false, though they may just stare intently at the Ok button till it's no longer greyed out. Unlucky.
    – Philip Oakley
    Commented Mar 25, 2016 at 15:12
-3

Some programs can invoke keypresses into your web browser. Take a look at VBScript's SendKeys() method.

This method sends keys to the currently focused window, and can send buttons such as ALT, TAB, and/or ENTER.

In a Windows Forms Application, a malicious developer can implement the SendKeys.Send() method and do some bad stuff, such as Alt-tab over to Firefox and click "Ok" on a malicious download link.

Improve this answer
4
  • 11
    If they're at the stage where you're running their VBScript or Windows Form Application then they already have control of your computer and wouldn't need Firefox or any other browser to get more stuff on there
    – Matthew Steeples
    Commented Mar 24, 2016 at 9:37
  • also, they could avoid this by enabling the button from code
    – beppe9000
    Commented Mar 25, 2016 at 11:59
  • Can't a page have VBScript embedded in it like a page can run JavaScript? Or, even, can't JavaScript access the same methods?
    – DDPWNAGE
    Commented Mar 29, 2016 at 23:06
  • 2
    @DDPWNAGE No. VBScript only ever worked in-browser in IE, and not even in IE11's Edge rendering mode. Even then, functions like SendKeys() never worked in browsers as far as I know, only in Windows Script Host. Just like you have a lot more access from a Node.js script than JS in the browser. The libraries and functionality is available in addition to the core language, and are only available in specific environments.
    – Bob
    Commented Apr 1, 2016 at 1:08
-4

I believe this is to make sure user see the dialog.
There are more attack vectors than the user typing trick that already described in other answers.
For instance USB HID based hacks. This is just some measure against both known and unknown attack vectors. Not just to patch particular set of known threat.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .