Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.comp.microsoft.windows > #702 > unrolled thread

What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)?

Back to article view | Back to alt.comp.microsoft.windows

Contents

  What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)?  Arlen   Holder <arlen_holder@newmachines.com> - 2020-11-13 16:16 +0000
    Re: What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)?  Arlen   Holder <arlen_holder@newmachines.com> - 2020-11-13 19:03 +0000
      Malicious buttons; was Re: What exactly do you click <snip> Mike Easter <MikeE@ster.invalid> - 2020-11-14 10:15 -0800
      Re: What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)? "Carlos E.R." <robin_listas@es.invalid> - 2020-11-14 19:49 +0100
        Re: What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)?  Arlen   Holder <arlen_holder@newmachines.com> - 2020-11-14 19:13 +0000
        Re: What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)? "Mayayana" <mayayana@invalid.nospam> - 2020-11-14 14:35 -0500
        Re: What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)? "Andrei Z." <no-email@invalid.invalid> - 2020-11-15 10:48 +0300
          Re: What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)?  Arlen   Holder <arlen_holder@newmachines.com> - 2020-11-20 00:04 +0000

#702 — What exactly do you click when you're confronted with "reddit wants to show notifications - allow - block - cancel (and why)?

What option do you click when you're confronted with a web-based
notification such as:
 "reddit wants to show notifications" - allow - block - cancel
 <https://i.postimg.cc/Wzf5ZQ8k/allowblockcancel01.jpg>

Here's why I ask... 
1. I'm researching backup hard disk drives as per this thread just now...
   o Google Photos will end its free unlimited storage on June 1st, 2021
     <https://groups.google.com/g/misc.phone.mobile.iphone/c/OCpy0JQSdVk>

2. To research drive types, in a VPN-based browser, I went here for data:
   <https://www.reddit.com/r/DataHoarder/comments/8xndpy/smr_vs_pmr_issues_and_drawbacks/>

3. Up pops this notification query (where I only have 3 possible choices):
   www.reddit.com wants to:
   Show notifications
   [Allow][Block][x]

4. Obviously I would never "allow", but the problem with "block" and "x" is
   that a nefarious site (perhaps not Reddit though) could switch the 
   buttons around, couldn't they?

   Given I have absolutely no idea what is _behind_ those buttons, 
   I'm inclined to do nothing, but that simply leaves the notification 
   up such that the site is grayed out.

   So my choice is either leave the site altogether, or click "something".

   But what?

5. I'm inclined to hit the "x"; but of course, that's only temporal, 
   since it solves nothing long term.

6. So it's a choice, for me, between [Block] & [x] where I ask your advice
   how _you_ make the choice between them.

   So that I benefit from your thinking process, what is your logic?
-- 
BTW, never do I _want_ notifications from any site or program, ever.
I wish the browser would just _not_ pop up these annoyances if possible.
But I have a score of browsers, so setting each up is problematic.
<https://i.postimg.cc/j5K0RL7H/taskbarmenu01.jpg>

[toc] | [next] | [standalone]

#703

On Fri, 13 Nov 2020 11:33:12 -0600, Zaghadka wrote:

> Click "block." Reddit wants to give you push notifications while you have
> the browser open. I know you well enough. You want them to piss off.
> 
> You can always undo it if you decide you want "browser notifications" but
> I can't imagine why you'd want your desktop to act like your phone.
> 
> "Cancel" basically means "I don't know what this is, please ask me again
> next time."
> 
> "Block" is "don't send notifications and don't ask again." 
> 
> "Allow" is "please interrupt my workflow like my phone does."
> 
> You don't want it. I guarantee it.

Hi Zaghadka,

This is more of a technical question than a social engineering question:
o *How hard is it for a nefarious web site to repurpose those buttons?*

Thanks for your purposefully helpful advice.
o Yes. We know each other well.

To summarize the "easy answer", it's to press [Block].
a. If I just hit the [x], it will nag me every time I return.
b. And I certainly never would hit the [Accept] (in a billion years!)

However, if it was that simple, I wouldn't be asking the question here, so
there is a nuance of detail that I didn't make clear (which is my fault),
and which I need to push a bit harder upon, which is nefarious intent.

The question is more technical than it at first appears
o *How "hard" is it for a nefarious site to repurpose the buttons?*

For example, what if [Block] actually _did_ something when I click it
(i.e., it did something completely unrelated to the "block" function)?

This is more of a technical question than a social engineering question:
o How hard is it for a nefarious web site to repurpose those buttons?
-- 
It's a technical question of whether anyone knows of nefarious intent.

[toc] | [prev] | [next] | [standalone]

#705 — Malicious buttons; was Re: What exactly do you click <snip>

Arlen Holder wrote:
> The question is more technical than it at first appears
> o *How "hard" is it for a nefarious site to repurpose the buttons?*

I think (or rather, Maybe) the strategies for that involve maliciously 
obfuscated javascript.

There are maestros of deobfuscating javascript to track down 'hidden' 
spam payoff links.

Obfuscating javascript in and of itself is not malicious, such as minifying.

-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#706

On 13/11/2020 20.03, Arlen Holder wrote:
> On Fri, 13 Nov 2020 11:33:12 -0600, Zaghadka wrote:
> 
>> Click "block." Reddit wants to give you push notifications while you have
>> the browser open. I know you well enough. You want them to piss off.
>>
>> You can always undo it if you decide you want "browser notifications" but
>> I can't imagine why you'd want your desktop to act like your phone.
>>
>> "Cancel" basically means "I don't know what this is, please ask me again
>> next time."
>>
>> "Block" is "don't send notifications and don't ask again."
>>
>> "Allow" is "please interrupt my workflow like my phone does."
>>
>> You don't want it. I guarantee it.
> 
> Hi Zaghadka,
> 
> This is more of a technical question than a social engineering question:
> o *How hard is it for a nefarious web site to repurpose those buttons?*

I understand those buttons are shown by the browser, not by the page.

I do not know exactly how push notifications work, but to work, they 
need a contributing browser. If the browser blocks them, it does not 
matter what the page tries to do, except that the browser has to act. It 
would perhaps warn that it is getting unrequested notifications.

I have said "no" to many sites, and not once do I get notifications. I 
think you can also block them globally, but I have not looked for it.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#707

On Sat, 14 Nov 2020 19:49:30 +0100, Carlos E.R. wrote:

>> o *How hard is it for a nefarious web site to repurpose those buttons?*
> 
> I understand those buttons are shown by the browser, not by the page.

I don't disagree that if what those buttons "do" are NOT CONTROLLED by the
web page, it makes it harder (perhaps even impossible?) for a web site's
nefarious code to repurpose those "browser" [block][allow][cancel] buttons.

[toc] | [prev] | [next] | [standalone]

#708

"Carlos E.R." <robin_listas@es.invalid> wrote

| I do not know exactly how push notifications work, but to work, they
| need a contributing browser. If the browser blocks them, it does not
| matter what the page tries to do, except that the browser has to act. It
| would perhaps warn that it is getting unrequested notifications.
|

In Firefox:

services.push.enabled
dom.webnotifications.enabled

  Those settings showed up with FF 44. (It's currently at
something like v. 80, so I guess that was a couple of
months ago. :)

  There are two ways I'm aware of for this to work. One is
that you load an invisible page that stays open in the
background, so the site can send messages. The other is
that Mozilla maintain a site where companies can post
messages you've allowed, and FF will periodically check
in to see if there's a message waiting.

  Both very creepy options, but as far as I know they
default to being disabled.

   The messages being discussed
sound like requests for push permission. I've never seen
those, but maybe it requires first enabling push. I rarely
enable script, but I do enable it partially for Reddit, which
is the only social media site I use. I've never seen any kind
of popup on Reddit.

[toc] | [prev] | [next] | [standalone]

#711

Carlos E.R. wrote:
> On 13/11/2020 20.03, Arlen Holder wrote:
>> On Fri, 13 Nov 2020 11:33:12 -0600, Zaghadka wrote:
>>
>>> Click "block." Reddit wants to give you push notifications while you 
>>> have
>>> the browser open. I know you well enough. You want them to piss off.
>>>
>>> You can always undo it if you decide you want "browser notifications" 
>>> but
>>> I can't imagine why you'd want your desktop to act like your phone.
>>>
>>> "Cancel" basically means "I don't know what this is, please ask me again
>>> next time."
>>>
>>> "Block" is "don't send notifications and don't ask again."
>>>
>>> "Allow" is "please interrupt my workflow like my phone does."
>>>
>>> You don't want it. I guarantee it.
>>
>> Hi Zaghadka,
>>
>> This is more of a technical question than a social engineering question:
>> o *How hard is it for a nefarious web site to repurpose those buttons?*
> 
> I understand those buttons are shown by the browser, not by the page.
> 
> I do not know exactly how push notifications work, but to work, they 
> need a contributing browser. If the browser blocks them, it does not 
> matter what the page tries to do, except that the browser has to act. It 
> would perhaps warn that it is getting unrequested notifications.
> 
> I have said "no" to many sites, and not once do I get notifications. I 
> think you can also block them globally, but I have not looked for it.
> 
Firefox
I have set dom.push.enabled to false.
No notifications requests and apparently connections to Mozilla Push server.
By default in Tor Browser (Firefox 78.4.0esr) and Thunderbird.

Mozilla
https://developer.mozilla.org/en-US/docs/Web/API/Push_API
Google
https://developers.google.com/web/fundamentals/push-notifications

[toc] | [prev] | [next] | [standalone]

#734

On Sun, 15 Nov 2020 10:48:09 +0300, Andrei Z. wrote:

> I have set dom.push.enabled to false.

UPDATE:

Just to let folks know, given I have a score of browsers, with _some_
browsers, you _still_ get nagged even when disabling notifications.
o <https://i.postimg.cc/hjp0Hxzy/pdf01.jpg>

See the bottom of that screenshot (ignore the annotations as they were made
for a different thread) where it shows the MS Edge Legacy nag which says:
 "postimg.cc wants to send you notifications, but first you need 
  to go to Settings and turn on Notifications"

[toc] | [prev] | [standalone]

Back to top | Article view | alt.comp.microsoft.windows

csiph-web