Hacker News Reader

Comment by jwcacces | Hacker News Reader

Looks like the perfect place to fake some browser chrome and trick people...

https://www.theregister.com/2017/01/19/browser_line_of_death...

I think you'll only get access to this API if the user has explicitly installed your app as a PWA, not just when visiting it as a webpage.

And then a shady company offers to buy the owner's website...

That’s a real problem, of course, but it seems fairly equivalent to any native app you install that can update itself or otherwise make a network request to obtain instructions.

I agree with you. On the other hand, in the case of a native application, we can hope that the antivirus removes it. I hope that Microsoft has planned to update Defender accordingly.

JavaScript malware has been a thing for a while now, and antiviruses have been targeting it accordingly.

It's not necessarily a JavaScript malware. A pure HTML page with a <form> tag could suffice to steal credentials.

Unlike the native app you probably won't have to worry about web page encrypted your files and asking a ransom.

For now

Native apps that autoselfupdate have RCE vulnerabilities by definition and should be considered remote access malware already, before the developer release keys are compromised.

I am the reason Signal desktop now has a preference to opt out of autoupdate.

"It won't happen to me."

XSS will mean that attackers control browser UI, that's kind of bad

Bad ? I thought that was a feature. "Want to change your browser behaviour ? Just put this CSS in user.js".

That was my first thought as well, but I couldn't remember the name for that boundary. I hope there is a well-designed per-site control/setting/user consent system to keep tech support scam sites (or worse!) from adding one more tool to their arsenal.

I’ve seen it called “The Line of Death”

https://textslashplain.com/2017/01/14/the-line-of-death/

Reply on news.ycombinator.com