Hacker News Reader

I think the only defense you could possibly have is to drag popups "outside" the main browser window. I run into this problem dealing with remote desktop windows and WU update dialogs (ok, so which machine is requesting a reboot now?). (I should theme my machines slightly differently to solve this problem).

The sad thing is that even with a real popup the only defense you have is the URI, and most of the time its incomprehensible tech-speak so realistically speaking normal everyday users don't stand a chance.

Password manager is best defense given it won’t auto fill in that bogus window.

It would need an extremely sophisticated password manager to actually fill that bogus "window".

Or extremely dumb one.

The only defense I have against this attack is that pop-ups annoy me and I always copy and paste the URL into my main browser window to login every time just out of spite.

it's because of the death of third party cookies. so now pop-ups are needed