Slashdot Mirror
Google Plans To Alter JavaScript Popups After Abuse From Tech Support Scammers (bleepingcomputer.com)
An anonymous reader writes: Chromium engineers are discussing plans to change how JavaScript popups work inside Chrome and other similar browsers. In a proposal published on the Google Developers portal, the Chromium team acknowledged that JavaScript popups are consistently used to harm users.
To combat this threat, Google engineers say they plan to make JavaScript modals, like the alert(), confirm(), and dialog() methods, only work on a per-tab basis, and not per-window. This change means that popups won't block users from switching and closing the tab, putting an end to any overly-aggresive tactics on the part of the website's owner(s).
There is no timeline on Google's decision to move JavaScript popups to a per-tab model, but Chromium engineers have been debating this issue since July 2016 as part of Project OldSpice. A similar change was made to Safari 9.1, released this week. Apple's decision came after crooks used a bug in Safari to block users on malicious pages using popups. Crooks then tried to extort payment, posing as ransomware.
To combat this threat, Google engineers say they plan to make JavaScript modals, like the alert(), confirm(), and dialog() methods, only work on a per-tab basis, and not per-window. This change means that popups won't block users from switching and closing the tab, putting an end to any overly-aggresive tactics on the part of the website's owner(s).
There is no timeline on Google's decision to move JavaScript popups to a per-tab model, but Chromium engineers have been debating this issue since July 2016 as part of Project OldSpice. A similar change was made to Safari 9.1, released this week. Apple's decision came after crooks used a bug in Safari to block users on malicious pages using popups. Crooks then tried to extort payment, posing as ransomware.
Took you fucking long enough!
I've encountered abusive ads on Slashdot doing those things and other malicious actions. It's hypocritical to complain about jlJavascript and advertising while making extensive use of it on this site. Users would be happy to subscribe, but instead of offering that option, we're stuck with potentially malicious ads and trackers. If you're going to complain about abusive ads and Javascript (and I agree about that), don't be hypocrites and potentially expose users to malware. Many of us would subscribe if given the option again.
I can't count how many times I have had to reload my 4chan pron after some popup from swfchan forced me to kill all of my chrome processes
Seriously, this has been a problem since Netscape first implemented alert(). Why has it taken this long for someone to fix it?
You are not alone. This is not normal. None of this is normal.
The scammers seem to have little worry in the face of calling them out on their shaniannigans. I've had them point out the google search results to ME about phone scammers and using that to describe the REAL bad people out there. They're looking for low hangin fruit and efforts need to be made to stop this from happening, not sure this will make much of a dent in this particular case.
I've found that i can right click on a tab to close it when it's been hijacked by models.
Why the fuck were pop-ups seizing control of the entire fucking browser in the first place?
I have often wondered why javascript prompts weren't tab specific. It is ridiculous to have a single tab interrupt you when in another tab.
All browsers should be doing this.
Like the originating URL, submission URL or some general flag that says the pop up is generated by a site, and not the browser.
Stupid pop-ups that take over the tab, that will not let you close it and make the phone's buzzer go off repeatedly.
You finally have to kill chrome completely.
Trying to find out what happened to the author of Darkout as he pretty much disappeared and abandoned it, I checked his website...the domain for which has been bought by some scummy shitbags. The mouse pointer started moving around inside the window - bit of a giveaway, that - and I got a popup warning me of all sorts of dire issues the site had found on the PC. Couldn't even close the page with the mouse, ctrl+w didn't work, etc. Ended up restarting the machine using the keyboard and just killing the tab on reboot. Damned if I know why I didn't install uMatrix on that machine as I'd do normally, but it's on there now.
The Darkout guy is now apparently working on Star Citizen. Read into that what you will.
Not sure when but in Safari Javascript popups come un in the tab, that you can switch away from.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Making the alert, confirm and dialog models tab based seems like a reasonable restriction while still allowing HTML5 apps which will probably use these models for not nefarious purposes. Anything more may be an inconvenience for HTML5 web app authors - but not a roadblock to scammers.
I'm looking at it from the perspective of having done a Google extension which required these models; while being available in the browser using Javascript, they're not available to extensions. As extensions go away and move to web apps, it will be nice to have this functionality as APIs, rather than the Javascript code we had to put together to provide the same functionality in the extension.
And therein lies the rub. If somebody wants to do something, especially if they are trying to steal from others, they will find a way - this is a speed bump at best. I'm sure that even as I write this, someone is coming up with a Javascript (now WebAssembly?) approach to locking up a browser and maybe the entire system until the user gives up their credit card number.
Mimetics Inc. Twitter
This is down my site
http://bit.ly/2njxMRq
It's the most common type of call I get now. I support over 1,000 users at various companies around my city and most are using application whitelisting and don't know their own admin passwords, so it's pretty much impossible for them to execute a real virus, the these javascript tricks are scaring them left and right. I get a call almost every day over it. They are so upset they can't settle down long enough for me to tell them "restart windows". When they finally listen to me and restart windows, they wont let me off the phone until after windows has restarted and they see facebook still works.
JavaScript is consistently used to harm users. There FTFY.
Assholes.
As far as I'm concerned browser devs are a bunch of cunts for allowing this shit in the first place and they all should be kicked square in the ass with razor studded boots for not fixing it sooner.
Javascript should have the same status as plugins with a "This site wants to enable javascript" dialog ... and it should be part of the standard. Sure you can run Noscript and manually white list sites, but that is kind of a kludge.
I actually stopped using Chrome at all, because I'd occasionally get an ad (don't ever click the low quality ads at the bottom of slashdot by accident) that prevented all interaction except to install some extension... and by all interaction, I mean no tab-switching, no keyboard shortcuts, no closing the window except to kill it externally. If you ask me its too little too late. Chrome doesn't even fix simple little things that don't cause a "buzz"... like keyboard text selection in the address box (everywhere else Shift + up selects everything to the beginning of the line ) Its definitely due for a 1000 paper cuts bugfix session.
One time i get more than 20 popup
Do it.
I wasn't aware DNS had anything to do with misbehaving JavaScript
I've constantly been saying this should be done in the Google Groups, the development boards and everywhere in the Chromium Development since it began.
Not to mention Firefox as well at the time
Modal dialogs for tabbed interfaces never made a single bit of sense.
There are ways to deal with it, like flashing a taskbar like literally every bit of software has done since modern OSes existed over a decade ago.
Flash the damn tab if it needs attention.
Window and tab management has sorely been lacking in modern tabbed software.
Even shit from the 90s has better child window and tab management than most software today!
Chromium pushed for tabs being the "center of attention", yet it was always lacking this idea fully because of the modality of dialog boxes.
If you want to make web browsers as an OS in miniature, make a damn tab management system!
It is bad enough on Chromium when you have that prick Ben who has probably never had more than 3 tabs open in his entire life so doesn't understand the usage of people that aren't Facebook babbies. Ben, killer of sidebars and life-giver to shitty pop-up balloons that die when you click off them. Fuck off.
But then, Chromium IS designed for retards. I keep forgetting that. Luckily that's why extensions exist, for the non-retards.
Modal dialogs should only ever be modal to the entire browser IF AND ONLY IF it involves the entire process. (memory errors, hardware faults, exit confirm, etc.)
Since I just disabled all pop-ups entirely. Occasionally I have to turn it on for a banking site and the very rare shopping site. But defaulting it to disabled and enabling it only when needed seems a much more sensible approach than defaulting it to enabled and disabling it on a case-by-case basis.
Stop ads infecting/tracking/slowing you via hosts (most efficient way) & APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads/script & malware rob speed/security/privacy
Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!
Avoids DNSChangers in routers/IP settings & dns redirects (99.999% of ISP DNS != patched vs. it) + lightens DNS load & resolves faster from local system RAM!
* Via what u NATIVELY have in the IP stack in FASTER kernelmode!
APK
P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/
Picture those letters in your mind for a moment. Now say out loud what they stand for. You're halfway there, you know what you need to do.
Oh, you mean like Firefox has been doing for YEARS? You mean as detailed in bug number FOUR HUNDRED AND FIFTY SIX out of 707,000 bugs filed so far in the Chromium bug tracker?
The Java spec is encumbered by Oracle copyright with licensing terms that prohibit distributing a work in progress implementation to the public. This means all new JVMs must be developed under NDA, not in the open. ECMAScript and the HTML DOM have no such encumbrance.
More and more applications are moving from platform-specific (eg, Windows) applications into the browser.
If an application runs in a Vagrant box, it can run on any platform that runs Vagrant. This includes Windows, macOS, and GNU/Linux. So if the sticking point is being platform-specific, why can't an app be distributed as a Vagrant box, and then the user uses an X11 server or RDP or VNC client to interact with it?
It's about time they made alert() dialogs tab-modal instead of window-modal. This is not so much news, as poor UX that should have been corrected long ago.
... Google will realize scammers are abusing float boxes.
I'm tired of clicking on the wrong link and having my whole browser window lock up from infinite popups, despite having ublock origin. No web page should be able to do that!
Opera Presto (that is, versions 12.x and earlier) had this years ago.
Put some control right on tab header and object-properties(image) to control download. So if i want to see a advt, i will right-click and show..
Just drop modals. They're a relic of the monotask OS'es of the past, and just awful for everything else. They were just annoying on windows 3.1, figure it today.
I reported this bug maybe with chrome 5 or 6.
It was marked duplicate will not fix.
Filed it again a bit later.
FINALLY
Oh note, there is also an HTTP Auth bug where it takes over the whole window... Hope they fix that too.
See subject & how ads work https://news.ycombinator.com/item?id=10221859/ downloading script to display ads from advertiser's servers which I block in hosts (thus no ads & more efficiently vs. NoScript by far which has to parse tags galore on pages - hosts block the sources LONG BEFORE that). Hosts also protect vs. DNS tracking (dns requestlogs) & it's many security issues seen below.
APK
P.S.=> DNS also has TONS of security & inefficiency issues galore by the 100's (partial list only) https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/ & hosts yield faster local system RAM resolution is FASTER vs. DNS (local or especially remote) + avoids ALL those issues via hardcoded favorite sites where you spend most of your time online & lightens DNS loads too (bonus, as DNS goes down a lot)... apk
It's not like you to allow a post to go unanswered. Did the advice finally land?! Let me know, maybe this whole episode is behind you at last.
Popups, boxes that follow you around the page as you scroll, sound that over-rides or ignores any browser mute functionality, allowing the close, ok, and cancel buttons to be remapped to anything else than the stated functionality (usually these get remapped to load malware or redirect to another site that loads more unwanted scripts/tabs), forced reload timers, right-click disabling, cascading tab loads, tab locks, automated non-default application launch, automated and silent extension/plugin installation.
The list could go on, but these are the prevalent ones that I've come across.I have no idea if any of these behaviors have a legitimate use at all, but I've yet to come across a legitimate use of any of them.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.
You missed a reply
You can figure out what the numbers represent. Why can't you act on what your own brain is telling you?