Browsers security in fullscreen players - javascript

This question is just something that I want to know (nothing is broken in code yay)
In the most browsers going to fullscreen causes the security adnotation coming (in most cases) from the top of the display.
I can not understand why it is suspicous, could you share your knowledge about why it is less secure to view (fe) the video in fullscreen mode?

The browser chrome is a trusted security indicator, and full-screen mode hides that indicator.
If a page could enter full-screen mode without the browser notifying the user, a malicious page could enter full-screen mode, draw Chrome's address bar, and look exactly like a Google login page to trick the user into giving their password.

Related

Detect in-app (webView or mini) browser on mobile

I have an Angular 9 app. I want to show some message when user open it on gmail in-app browser. I did't find a way difference between gmail in-app browser and Safari on iPhone. I've tried those approaches: detect ipad/iphone webview via javascript, check for indexeddb, Navigator.canShare() and they didn't help. navigator.userAgent are same on those browsers. Please help to find differences.
#maksym do you wish to differentiate the user sessions when your website is opened in the web driver of Gmail IOS app?
On iPhone, the viewport height is slightly different (iPhone 8: 1445 in Safari, 1461 in Gmail).
If:
user email domain is Gmail
iOS mobile user agent match
Gmail viewport size match (different per device)
assume user is in Gmail app
show interstitial page prompting user to click Safari link in bottom right, & also smaller sized link warning to 'Continue in Gmail app' if you want.
Note: This would not work for custom domains, or you would have to map them somehow.
You might consider promoting the Add To Home Screen (ATHS) process prior to the user completing registration. As long as it’s optional and doesn’t really block the user from completing registration itself, you have nothing to lose.

android:windowSoftInputMode... is there a javascript/meta tag/"web page" config equivalent?

I've got a web site "application" which is not an app, but an actual web page you'd use through Chrome or some other browser. In iOS invoking the keyboard (via an input element for example) doesn't change the viewport ratio or resize anything, but on Android it does. This is causing insane layout problems for my app "page", as we have to distinguish between portrait and landscape view orientations.
I found many answers about android:windowSoftInputMode activity configs w/rt keyboard display and interaction with media queries, and how to specify your desired value (in my case, "adjustNothing"), but I haven't found anything on how to invoke this configuration when you're looking at a web page via chrome or any other browser.
So does anyone know of a way to do this via JavaScript or some other in-page code? Thanks.

Firefox : Force full-screen mode from webpage

I am developing a web-based database that needs to be opened through firefox web browser(because of some css3 elements). I want the page to open automatically in full screen mode. I dont want the user of the database to have access to the firefox menu items
Can't be done if you just have control of the webpage. Controls in the webpage cannot cause changes in the browser instance itself.
It would be a security issue if that were allowed. You could look into writing a Firefox extension to do that, as they have more access to the browser instance itself.
You shouldn't look at trying to hide the firefox menu controls. That seems like a flaw in your problem-solving approach.
You will want to look at Fullscreen APIs of the browser. If you accept a small request/info to the user in the application it can be done quite easily. You just can't force the user into Fullscreen mode against his will. This is good (for security reasons).
http://hacks.mozilla.org/2012/01/using-the-fullscreen-api-in-web-browsers/

html5 mobile webapp add to homescreen issue

I have a webapp and it looks good when assigned to a users homescreen (ios) but not as good when just going to it from safari. Is there a way to control which scripts/items run when the webapp is accessed from safari only? And then a sepperate script/code to run when launched from the homescreen?
I assume the web page is set up to use no address bar etc, when launched from home screen link. And you want to detect when it's not launched that way (to correct for smaller vertical space etc.)
Then what you want to detect is "app mode" or "standalone mode". This site seems to explain quite well how to detect it.
(In case this link dies in the future) in essence the test is
if ( ("standalone" in window.navigator) && !window.navigator.standalone ){
// Not standalone/fullscreen here (visiting from safari)
}else{
//Fullscreen mode (launched from homescreen)
}

Do browsers ignore window parameters when opening new windows via javascript?

I'm opening a popup window via javascript. I'm trying to set some of the display parameters - specifically we want to hide the location and statusbar, but every browser I've tested this in, the location and status bars still display.
My code looks like this:
newwindow=window.open(url,'name','height=250,width=290,left=200,top=200,location=no,resizable=yes,scrollbars=yes,toolbar=no,status=no');
Any ideas? The client is insisting on a popup window, rather than a hover tooltip.
The browsers have stopped listening to some of the parameters for security reasons. For example, FF3+ and IE6 / 7+ force a location bar to prevent scammers pretending to be a site they're not.
Related: The Internet Explorer 7 Security Status Bar
Whenever you are visiting any website, you should look at the full address (URL) for the site to understand what website you are looking at. IE7 helps you by enforcing the presence of an address bar in every window, but you still may need to scroll through it or maximize the window in order to view the full address.
If you need more freedom, and happen to have some control over the user's computer (e.g. in a closed intranet), there are solutions like Mozilla Prism that allow a web site to appear rather like a desktop application. But those are highly specialized solutions unsuitable for normal web sites.
Yes, some parameters are disabled. The reason is that it should not be possible to open a window that pretends to be something else.
The exact rules depends on the browser, the scope of the page (intranet/public), and the user settings. Most browsers won't remove the address bar, so that you can always see where the page is coming from.
You can for example read here about the restrictions in Internet Explorer.
Some quotes:
"Internet Explorer 6 for Windows XP
SP2 requires that the window title
bar and status bar are always in the
visible area of the display; if the
address bar is displayed, it must also
remain visible. By placing these
restrictions on script-opened windows,
the Window Restrictions security
feature prevents malicious code from
hiding information and from spoofing
user interfaces. The Window
restrictions feature is on by default
for the Internet zone, and the feature
is off by default for the Local
Intranet and Trusted Sites zones."
and:
"The status bar is an Internet
Explorer security feature that
provides the user with Internet
Explorer security zone information.
Prior to Internet Explorer 6 for
Windows XP SP2, the status bar could
be hidden from the user by scripts
that call the window.open method. With
the status bar hidden from view, users
could be deceived into thinking that
they were on a trusted site when they
were actually interacting with a
malicious host.
With window restrictions in place, the
status bar cannot be turned off for
any window created by the window.open
method; it is always visible for all
Internet Explorer windows. The zone
information that the status bar
contains cannot be spoofed or hidden
from view, so that the user always
knows in what security zone the
content is being displayed."
This is about IE 6, as that's when this was introduced. There were some furhter changes in IE 7, but that mostly has to do with how the navigation changed, making some parameters of the open command work differently or being obsolete.
Due to changes in security models, it's not possible to have a totally chromeless popup window any more and attempts to strip all the chrome off will simply be ignored. Have you considered using JQuery to create a pseudo-popup that is skinned to look like a window, give it drag handlers and a dismiss button? you could gracefully degrade to a standard pop-up.
http://jqueryui.com/demos/draggable/
Most browsers displays the location bar and status bar by default, and make it also impossible to override window.status. This is done for safety (to guard against phishing).
Some more specific information on how a user can change the setting that allows the status and/or address to be set by Javascript to hidden or visible:
From the 'custom level' dialog from the IE security tab - scroll down to:
"Allow websites to open windows without address or status bars"
Depending on if these is set to Disable or Enable - you will see different behavior from your application.
To my knowledge this applies to IE7, IE8, and IE9

Categories