Comment by sorbus | Hacker News Reader

Comment by sorbus | Hacker News Reader

So you go to a malicious website and it's able to move your mouse around or lock it in place. That would not be a good situation to be in, especially for the segment of the population that doesn't understand keyboard shortcuts (which would, presumably, allow escape from this). Even if it's not used maliciously, it seems very plausible that it would be used to make advertisements harder to avoid (on websites like Hulu that run ads during a video, preventing most users from being able to go elsewhere during them could be a tempting idea).

I get why something with this effect is necessary if we are to have FPS games running in the browser, I just don't think that it's a good idea to allow websites to do so without explicit user permission. Admittedly, there are few things I hate as much as programs moving my mouse around, so I'm a bit biased.

The article's suggestion does not say the mouse would be moved or locked by the web program. The program would be able to hide the cursor (which it can already do) and receive 'virtual' mouse coordinates.

My main concern is number overflow for long-running applications, but I seriously doubt this will be a problem for anyone.

I don't see any security problems with the proposed solution (though I don't claim to be a security expert!).

I may be hugely misreading the article, but when it says "The mouse will be anchored to that position and the mousemove events are going to set a virtual position" and "Everytime the user moves the mouse ... the cursor is moved to the center of the screen" I find it difficult to interpret that in any way that doesn't effectively mean that a website is able to move or lock the cursor. I admit that I use cursor and mouse interchangeably, when they're actually not the exact same thing, however.

Okay, I missed "The mouse will be anchored to that position" part. I really disagree with this part of the proposal. Thanks for pointing it out.

However, the comment about the cursor moving to the centre of the screen is an implementation detail. At least on Windows, you need to centre the mouse cursor for something like this because the OS won't (easily) give you actual virtual coordinates.

Javascript can hold full precision integers up to 2^53. Let's say you can mouve by 1024 pixels per seconds. It would take 2^53 / (3600 * 24 * 365.25) ~= 280 000 years to get beyond the limit.

I think we are pretty safe on that part, even for veery long running app.

Reply on news.ycombinator.com