DoubleClickjacking: A New type of web hacking technique

Hmm. I guess it is never impossible that there’s a version of something that will trick people consistently. But, I’m kinda struggling to recall a time I’ve needed to double click on a website.

Actually the double-click action is pretty rare nowadays, right? In particular, I use it a lot to select a word in a terminal, but most of the time when I am getting UI instructions it is from a website about how to use the website itself, and since that’s a website it has to be abstract enough to also make sense for mobile users.

Telling people to double click is, I think, mostly dead.

It doesn’t need to be a literal double click. It could be something like a CAPTCHA “confirm you’re human,” where you click once, it appears to load, and then you click a confirm button. Do it fast enough and it might appear like a double click.

Not sure this would work with the exploit though.

My mother constantly struggles between when to double click or not after decades of using computers. This is probably an issue that will die out with her generation, though.

Entirely separate, a common failure mode of dying mice is that they start generating spurious clicks. I've had a couple of logitechs do this to me. And the thing about scams is you can often legit make money off of very low success rates.

Google drive and similar sites use double click for folders to open similar to a regular OS would. Single click tends to show some metadata where the double click does the actual navigation.

it pisses me off

> Entirely separate, a common failure mode of dying mice is that they start generating spurious clicks.

Speaking of things dying out, it's been so long since I used anything but a trackpad that I thought at first this was some strange claim about rodents!

YouTube gets me to double-click on occasion:

- The page mostly loads

- An ad starts playing

- I attempt to hit "pause" while I go handle a thing or two [0]

- As I'm about to click "pause", the layout shifts to the left exactly enough for me to unmute the ad

- I immediately click again to stop listening to whatever scam is currently being peddled

[0] For some videos I like to read the description before watching. For all videos I like to make it as obvious as possible to Google that there isn't a real person watching the ad (browser not focused, ad muted, ...).