Google Plans To Alter JavaScript Popups After Abuse From Tech Support Scammers (bleepingcomputer.com) 118
An anonymous reader writes: Chromium engineers are discussing plans to change how JavaScript popups work inside Chrome and other similar browsers. In a proposal published on the Google Developers portal, the Chromium team acknowledged that JavaScript popups are consistently used to harm users.
To combat this threat, Google engineers say they plan to make JavaScript modals, like the alert(), confirm(), and dialog() methods, only work on a per-tab basis, and not per-window. This change means that popups won't block users from switching and closing the tab, putting an end to any overly-aggresive tactics on the part of the website's owner(s).
There is no timeline on Google's decision to move JavaScript popups to a per-tab model, but Chromium engineers have been debating this issue since July 2016 as part of Project OldSpice. A similar change was made to Safari 9.1, released this week. Apple's decision came after crooks used a bug in Safari to block users on malicious pages using popups. Crooks then tried to extort payment, posing as ransomware.
To combat this threat, Google engineers say they plan to make JavaScript modals, like the alert(), confirm(), and dialog() methods, only work on a per-tab basis, and not per-window. This change means that popups won't block users from switching and closing the tab, putting an end to any overly-aggresive tactics on the part of the website's owner(s).
There is no timeline on Google's decision to move JavaScript popups to a per-tab model, but Chromium engineers have been debating this issue since July 2016 as part of Project OldSpice. A similar change was made to Safari 9.1, released this week. Apple's decision came after crooks used a bug in Safari to block users on malicious pages using popups. Crooks then tried to extort payment, posing as ransomware.
Oh well (Score:5, Informative)
Took you fucking long enough!
Re: (Score:3)
Re: (Score:2)
Maybe there should be some highly visible difference between sites that use Javascript and those that do not? Like the tab changing color -- just to throw up a silly idea.
If Javascript could only affect that one tab that it runs in, then what harm could Javascript do?
Re: (Score:2)
I would like to have scroll bars that are consistent some websites hide the scroll bar or make it so small it's hard to hit reliably with a mouse.
Sure it might make the site look a bit better but everyone doesn't have a touchscreen and it sure makes the site a pita to use without working scrollbars.
Re: (Score:2)
Re: (Score:2)
"The real answer is to put the user in control, by default, of the way the page renders."
And thereby destroying the core use case for CSS. What?
Re: (Score:2)
HTML, with or without CSS, was never supposed to be pixel-exact. Half of the problems with browsers relates to ignorance and even downright hostility to that notion.
It's fine if there is a "pixel-exact to designer intention" mode, but given the absolute GLUT of shit design, there must also be a "fuck the designer, display things THIS way" switch.
Re: (Score:1)
"The real answer is to put the user in control, by default, of the way the page renders."
And thereby destroying the core use case for CSS. What?
Apparently you're totally ignorant of the actual purposes of HTML, and CSS for that matter. It's only guidance to how things are to be displayed, it's not nor ever was meant for the developer/designer to actually "control" what comes out on the other end. The sooner you realize that, the happier and more productive you'll be, and the fewer bugs you'll have in your code.
Re: (Score:2)
How many of these obscure the scroll bar just to trick you into clicking the page and getting their lovely ads, subscription, and notification come-ons?
Re: (Score:2)
IDK I think twitch just does it for looks with no option to override.
Re: (Score:2)
The fact that they do this says something about the intentions of the site's owners.
If the site's owners have bad intentions, a technical fix is not going to help for very long. They will find other ways to screw you over. You can't change their bad intentions with a technical fix to your web browser.
Re: (Score:1)
> Shoving Javascpt shit down our throats has not created anything of value
Javascript has created a lot of value. For instance, Javascript can request huge amounts of information on your local machine, to solidly fingerprint you. They can then add this fingerprint to a database, and it is often good enough to track you all around the web.
To combat problem users, they just started putting a bit of javascript to actually load the webpage too. That way users will enable javascript, and the fingerprinting
Re: (Score:2)
Both.
But not 'web designer'. An application developer.
JavaScript is more free than Java (Score:1)
The Java spec is encumbered by Oracle copyright with licensing terms that prohibit distributing a work in progress implementation to the public. This means all new JVMs must be developed under NDA, not in the open. ECMAScript and the HTML DOM have no such encumbrance.
Re: Oh well (Score:2)
vagrant up (Score:2)
More and more applications are moving from platform-specific (eg, Windows) applications into the browser.
If an application runs in a Vagrant box, it can run on any platform that runs Vagrant. This includes Windows, macOS, and GNU/Linux. So if the sticking point is being platform-specific, why can't an app be distributed as a Vagrant box, and then the user uses an X11 server or RDP or VNC client to interact with it?
Re: (Score:2)
Because the two are not even remotely comparable. Are you seriously asking why we don't download hundreds of megabytes or a gigabyte or two VM image as opposed to 500KB of JS in a browser?
Re: (Score:2)
They did that already it's just not a very popular option
chrome://settings/content tick "Do not allow any site to run JavaScript" click done.
Re: Oh well (Score:1)
Damn you've been using crippled net so long you didn't notice YouTube can do decent video. That happened years ago BTW.
I leave everything on, Java, JS, Flash.
I don't care. If I get infected all I have to do is clone my old unplugged drive again.
Re: (Score:2)
Re: (Score:2)
Badly coded legacy sites.
These are not popups as you traditionally know them - these are like the Javascript alert() and prompt()
Re: (Score:1)
The posted article is not "slashdot complaining about javascript." If it were then your statement would make more sense.
Re: (Score:2)
On really short pages (3 or 4 comments), you can't even scroll to the bottom of the page - the ad js forces you back up. You can't read the last comment on the page without disabling JS.
Re: (Score:2)
Users would be happy to subscribe, but instead of offering that option, we're stuck with potentially malicious ads and trackers.
Slashdot used to offer subscriptions years ago. Nowadays it seems only SoylentNews offers that.
Comment removed (Score:5, Informative)
Re:It's taken... how many decades? (Score:5, Informative)
But Firefox fixed this years ago. All of the alerts are bound to the tab and not the window.
Re: (Score:2)
A better fix would just be to disable the damn thing. I can't think of a single time I've found a javascript pop-up useful.
Re: (Score:1)
A better fix would just be to disable the damn thing. I can't think of a single time I've found a javascript pop-up useful.
Oh, all the time, especially when I'm in development.
Re: (Score:1)
Use console.log
Re: (Score:2)
Dev tools can do all that. You can break when elements change, etc., or have JS breakpoints wherever you want. You can even get a frame-by-frame trace of the app's behaviour should you want.
Re: (Score:1)
Re: It's taken... how many decades? (Score:2)
They are useful for confirming actions, especially delete functions of things. It's not often I use them on a public facing site, though. When it comes to the Administration of the site, I use them frequently.
With that said, I've moved most of my projects to an inline modal (constructed inside of the page using HTML/CSS/JS). Way more flexibility, and less user annoyance.
I hadn't noticed (Score:2)
Re: (Score:2)
It sounds like you're talking about pop-up windows, not pop-up dialogs, like alert() and confirm().
Re: (Score:2)
That's easy for them when their entire UI is XUL and basically just HTML/JS already.
Re: (Score:3, Informative)
Firefox fixed this in early 2011. It's Chrome that's lagging behind in this case.
Re: (Score:2)
TIL'd and from a AC !
wow the internet is truly doomed...
Safari also fixed this... (Score:3)
Not sure when but in Safari Javascript popups come un in the tab, that you can switch away from.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Opera's had a "Disable scripts on this page" button in the alert boxes for as long as I can remember.
Re: (Score:2)
Why not then employ stronger tactics against them... like a broadside [jollyrogertelephone.com]?
Just this week I had such a redirect & popup (thanks to a compromised WordPress site I was visiting), noted the # and set it along with a screenshot. A couple of hours later the phone # was no longer picking up as clearly they realized they weren't going to get any more legit calls in through it.
Maybe it's different on Linux (Score:2)
I've found that i can right click on a tab to close it when it's been hijacked by models.
Re: (Score:1)
I've found that i can right click on a tab to close it when it's been hijacked by models.
Is that the one where one goes down on you while the other steals your wallet? Because I already heard that one.
Re: (Score:2)
I've found that i can right click on a tab to close it when it's been hijacked by models.
Is that the one where one goes down on you while the other steals your wallet? Because I already heard that one.
That happened this morning. It felt good until it was really bad.
Re: (Score:2)
They got me three times last week, and twice so far this week. Has to stop.
What the hell (Score:1)
Re: (Score:2)
Isn't that the point of modal dialogs/windows?
Re: (Score:1)
Yes. The question stands: why the fuck was this behavior ever supported in the first place?
Re: (Score:2)
> why the fuck was this behavior ever supported in the first place?
You know exactly why this behavior was desired, and it was never in the interest of the user.
Re: (Score:2)
Likely because it dates back to the pre-tab era when you just had one window in the first place. Once tabs became a thing, the paradigm was never updated. Hopefully they get this in there quick.
Re: (Score:2)
Even then, one repeating alert() box kept you from closing the browser window.
How about more info on the dialog? (Score:5, Insightful)
Like the originating URL, submission URL or some general flag that says the pop up is generated by a site, and not the browser.
Re: (Score:2)
I think these modal dialog boxes are always generated by sites, not the browser. You shouldn't need more info, because they should only be shown while you're on the relevant tab (Firefox does this now; it used to force-switch to the tab whenever a modal was generated).
Just in time for HTML5 Web Apps (Score:2)
Making the alert, confirm and dialog models tab based seems like a reasonable restriction while still allowing HTML5 apps which will probably use these models for not nefarious purposes. Anything more may be an inconvenience for HTML5 web app authors - but not a roadblock to scammers.
I'm looking at it from the perspective of having done a Google extension which required these models; while being available in the browser using Javascript, they're not available to extensions. As extensions go away and move
It's a big problem (Score:2)
Re: (Score:3)
It sounds more like a problem with your users being drooling idiots.
Re: (Score:3, Funny)
It's like they say: you can pick your friends, but you can't pick your users. Can't live with them, can't kill them.
Re: (Score:2)
For chrissakes, most users are drooling idiots. Pretty much every application, but in particular every application that connects to the Internet, has to take into account that the odds are fairly good that the person sitting in front of the keyboard is a drooling idiot.
Re: (Score:2)
It sounds more like a problem with your users being drooling idiots.
Well I've run into some of these that manage to
a) create a pop-up window that covers almost the whole screen without the usual navigation
b) throw the modal dialog in an infinite loop, you must check that little "stop creating dialogs" box to escape
c) use a reload/redirect trigger/timer so you get sent to a new page with a new dialog if you break the b) loop
It's fucking annoying and I could very well understand a clueless user thinking he's been hacked. I've not managed to find any way out of the most annoyi
It's about damn time... (Score:1)
As far as I'm concerned browser devs are a bunch of cunts for allowing this shit in the first place and they all should be kicked square in the ass with razor studded boots for not fixing it sooner.
Like Firefox? (Score:2)
Finally! (Score:1)
In ten years... (Score:2)
About time! (Score:2)
Annoying JavaScript behaviors (Score:1)
Popups, boxes that follow you around the page as you scroll, sound that over-rides or ignores any browser mute functionality, allowing the close, ok, and cancel buttons to be remapped to anything else than the stated functionality (usually these get remapped to load malware or redirect to another site that loads more unwanted scripts/tabs), forced reload timers, right-click disabling, cascading tab loads, tab locks, automated non-default application launch, automated and silent extension/plugin installation