←back to thread

DoubleClickjacking: A New type of web hacking technique

(www.paulosyibelo.com)
237 points shinzub | 3 comments | 14 Jan 25 04:44 UTC | HN request time: 0.626s | source
Show context
yellow_lead ◴[17 Jan 25 18:23 UTC] No.42741585[source]▶
Am I mistaken or does this require the user to allow pop-ups?
replies(1): >>42741795 #
1. gruez ◴[17 Jan 25 18:41 UTC] No.42741795[source]▶
Default configuration for most browsers is to allow popups if it was initiated by a user action.
replies(2): >>42746238 #>>42750837 #
2. yellow_lead ◴[18 Jan 25 06:02 UTC] No.42746238[source]▶
Ah, thanks, that makes sense.
3. xp84 ◴[18 Jan 25 19:42 UTC] No.42750837[source]▶
They also usually open tabs on most new window operations (I think when the page doesn’t specify window dimensions) rather than windows. Which doesn’t matter much but to my laziness makes it even easier to line the evil page’s double click target with the “allow” button you’re meant to hit.