4 ms·
"Press here to view the content", there's already plenty in the wild that grant access to notifications with deceptive buttons.
by unfocso 3mo ago
"Press here to view the content", there's already plenty in the wild that grant access to notifications with deceptive buttons.
- cwmoore 3mo ago“targeted and functional controls for accessing camera and microphone streams”
- sheept 3mo agoThe similar <geolocation> element has clickjacking prevention enforced by the browser[0], and even if the website finds a way around it, it still shows the normal permission prompt.[1] [0]: https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeolocationElement/invalidReason#value https://developer.mozilla.org/en-US/docs/Web/API/HTMLGeoloca... [1]: https://mdn.github.io/dom-examples/geolocation-element/basic-watch-example/ https://mdn.github.io/dom-examples/geolocation-element/basic... (requires Chromium)
- ameliaquining 3mo agoTo be sure, evil websites will still be able to put misleading content around the element, and hope that the least savvy users will be fooled or will click the button out of confusion. But they can already do that with the existing JavaScript-triggered permission prompt.
- akersten 3mo agoIt's kind of insane to me that effort was put into all these fuzzy make-your-site-randomly-not-work heuristics and at the end of the day it still pops open the permission dialog anyway. It's like the worst of both worlds