Slashdot Mirror
Google Plans To Alter JavaScript Popups After Abuse From Tech Support Scammers (bleepingcomputer.com)
An anonymous reader writes: Chromium engineers are discussing plans to change how JavaScript popups work inside Chrome and other similar browsers. In a proposal published on the Google Developers portal, the Chromium team acknowledged that JavaScript popups are consistently used to harm users.
To combat this threat, Google engineers say they plan to make JavaScript modals, like the alert(), confirm(), and dialog() methods, only work on a per-tab basis, and not per-window. This change means that popups won't block users from switching and closing the tab, putting an end to any overly-aggresive tactics on the part of the website's owner(s).
There is no timeline on Google's decision to move JavaScript popups to a per-tab model, but Chromium engineers have been debating this issue since July 2016 as part of Project OldSpice. A similar change was made to Safari 9.1, released this week. Apple's decision came after crooks used a bug in Safari to block users on malicious pages using popups. Crooks then tried to extort payment, posing as ransomware.
To combat this threat, Google engineers say they plan to make JavaScript modals, like the alert(), confirm(), and dialog() methods, only work on a per-tab basis, and not per-window. This change means that popups won't block users from switching and closing the tab, putting an end to any overly-aggresive tactics on the part of the website's owner(s).
There is no timeline on Google's decision to move JavaScript popups to a per-tab model, but Chromium engineers have been debating this issue since July 2016 as part of Project OldSpice. A similar change was made to Safari 9.1, released this week. Apple's decision came after crooks used a bug in Safari to block users on malicious pages using popups. Crooks then tried to extort payment, posing as ransomware.
Took you fucking long enough!
Seriously, this has been a problem since Netscape first implemented alert(). Why has it taken this long for someone to fix it?
You are not alone. This is not normal. None of this is normal.
I've found that i can right click on a tab to close it when it's been hijacked by models.
Why the fuck were pop-ups seizing control of the entire fucking browser in the first place?
Like the originating URL, submission URL or some general flag that says the pop up is generated by a site, and not the browser.
Not sure when but in Safari Javascript popups come un in the tab, that you can switch away from.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Why not then employ stronger tactics against them... like a broadside?
Just this week I had such a redirect & popup (thanks to a compromised WordPress site I was visiting), noted the # and set it along with a screenshot. A couple of hours later the phone # was no longer picking up as clearly they realized they weren't going to get any more legit calls in through it.
Help Brendan pay off his student loans
Making the alert, confirm and dialog models tab based seems like a reasonable restriction while still allowing HTML5 apps which will probably use these models for not nefarious purposes. Anything more may be an inconvenience for HTML5 web app authors - but not a roadblock to scammers.
I'm looking at it from the perspective of having done a Google extension which required these models; while being available in the browser using Javascript, they're not available to extensions. As extensions go away and move to web apps, it will be nice to have this functionality as APIs, rather than the Javascript code we had to put together to provide the same functionality in the extension.
And therein lies the rub. If somebody wants to do something, especially if they are trying to steal from others, they will find a way - this is a speed bump at best. I'm sure that even as I write this, someone is coming up with a Javascript (now WebAssembly?) approach to locking up a browser and maybe the entire system until the user gives up their credit card number.
Mimetics Inc. Twitter
The posted article is not "slashdot complaining about javascript." If it were then your statement would make more sense.
It's the most common type of call I get now. I support over 1,000 users at various companies around my city and most are using application whitelisting and don't know their own admin passwords, so it's pretty much impossible for them to execute a real virus, the these javascript tricks are scaring them left and right. I get a call almost every day over it. They are so upset they can't settle down long enough for me to tell them "restart windows". When they finally listen to me and restart windows, they wont let me off the phone until after windows has restarted and they see facebook still works.
As far as I'm concerned browser devs are a bunch of cunts for allowing this shit in the first place and they all should be kicked square in the ass with razor studded boots for not fixing it sooner.
Since I just disabled all pop-ups entirely. Occasionally I have to turn it on for a banking site and the very rare shopping site. But defaulting it to disabled and enabling it only when needed seems a much more sensible approach than defaulting it to enabled and disabling it on a case-by-case basis.
On really short pages (3 or 4 comments), you can't even scroll to the bottom of the page - the ad js forces you back up. You can't read the last comment on the page without disabling JS.
Oh, you mean like Firefox has been doing for YEARS? You mean as detailed in bug number FOUR HUNDRED AND FIFTY SIX out of 707,000 bugs filed so far in the Chromium bug tracker?
More and more applications are moving from platform-specific (eg, Windows) applications into the browser.
If an application runs in a Vagrant box, it can run on any platform that runs Vagrant. This includes Windows, macOS, and GNU/Linux. So if the sticking point is being platform-specific, why can't an app be distributed as a Vagrant box, and then the user uses an X11 server or RDP or VNC client to interact with it?
Users would be happy to subscribe, but instead of offering that option, we're stuck with potentially malicious ads and trackers.
Slashdot used to offer subscriptions years ago. Nowadays it seems only SoylentNews offers that.
It's about time they made alert() dialogs tab-modal instead of window-modal. This is not so much news, as poor UX that should have been corrected long ago.
... Google will realize scammers are abusing float boxes.
Opera Presto (that is, versions 12.x and earlier) had this years ago.
Popups, boxes that follow you around the page as you scroll, sound that over-rides or ignores any browser mute functionality, allowing the close, ok, and cancel buttons to be remapped to anything else than the stated functionality (usually these get remapped to load malware or redirect to another site that loads more unwanted scripts/tabs), forced reload timers, right-click disabling, cascading tab loads, tab locks, automated non-default application launch, automated and silent extension/plugin installation.
The list could go on, but these are the prevalent ones that I've come across.I have no idea if any of these behaviors have a legitimate use at all, but I've yet to come across a legitimate use of any of them.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.