RE: Secure Chrome

Just to be clear, this particular FSTC requirement refers to dialog boxes,
not the padlock icon or anything else in the main browser window.

For example, when the basic auth dialog pops up the end user needs some
assurance it's really the browser's built-in dialog, not a script generated
dialog.

At minimum browsers could put some warning indicator in the title bar of
script generated windows.  Do any client side document object models allow
scripts to modify the title bar property of windows?  The models may need to
change.

I know -- not real satisfying.  True fulfillment of this requirement may
require OS changes.

Mike

-----Original Message-----
From: Jeffrey Altman [mailto:jaltman@secure-endpoints.com] 
Sent: Friday, April 14, 2006 9:10 AM
To: McCormick, Mike
Cc: public-usable-authentication@w3.org
Subject: Re: Secure Chrome

Michael.Mccormick@wellsfargo.com wrote:

>  - Make built-in browser dialog boxes visually distinguishable from 
> script generated dialog boxes

This is the real catch.  You almost want a requirement that says as long as
the browser is using graphic image 'lock' to represent a state of security
that no image similar to 'lock' can be displayed as part of the content
obtained from the web site.  Without such a requirement the attackers simply
use the paint a fake browser within the browser window attack.

Jeffrey Altman