安全与隐私textslashplain.com
生死线：浏览器安全边界的思考
The Line of Death
2017 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
《The Line of Death》讲浏览器安全 UI 中的一条界线：地址栏、锁图标等由浏览器自身绘制的“可信界面”绝不能让网页内容越界绘制，否则钓鱼页面可伪装成浏览器提示。文章解释这条界线为何存在、历史上被跨越的案例，以及为什么安全 UI 很难做。
为什么经久不衰：因为它用一条简单界线揭示了钓鱼与浏览器信任模型的核心矛盾，今天浏览器内伪造窗口、WebAuthn 等讨论仍绕不开它。
HN 评论精选
安全 UI 失败根源是厂商和用户都不真正关心理解风险，非技术用户对死亡线无感。
我认为真正的问题是：人人都关心可用性，却没人真正关心用户。浏览器和 Web 应用努力让上网变容易，却不努力说清楚你正在做什么、风险是什么；实际上大家都在淡化风险、隐藏真实运作方式。多少用户理解“死亡线”，或不同像素由不同程序绘制这一基本事实，更别说 URL 结构、Unicode，以及 rnicrosoft.com 不是他们要的网站？没什么能让他们理解这些。软件厂商乐见用户无知，用户也乐意保持无知。不是说我知道怎么修，只是经验告诉我，非技术用户完全不知道发生了什么，所以“死亡线”对他们根本不存在。
yosefk查看英文原文
I think the real issue is that everybody cares about usability but nobody actually cares about the users. Browsers, web apps, etc. try hard to make it easy to browse the web, but they don't try very hard to make it clear exactly what you're doing and what the risks are - in fact, everyone tries rather hard to downplay the risks and to hide how things actually work. How many users understand "the line of death", or the basic fact that different pixels are drawn by different programs, not to mention URL structure, or (gasp) Unicode and how it fits there, or how rnicrosoft.com isn't what they're looking for? What makes them understand this? Nothing. Software vendors are very happy with uninformed users (in fact these are the best users because they don't realize which of your programs and services can be replaced with an alternative and how), and users are very happy to stay uninformed, too. Not saying I know how to fix this, just that in my experience non-tech people are so completely unaware of what's going on that this "line of death" thing is not even a thing for them.
论文实验表明，把风险提示放在死亡线以上、提醒异常比绝对阻止更能让用户感到安全。
我的硕士论文研究浏览器如何帮助用户防范欺骗风险。结论是：我们无法阻止攻击者模仿或操纵 UI/UX 元素，但可以更关注用户交互和细微线索，而非死板的允许/阻止列表。我们讨论了当前多数浏览器警告画在死亡线以下，容易被钓鱼站模仿；用户点“返回安全”却到了真正的钓鱼页。实验之一是把警告放到死亡线以上，用风险指示器取代安全指示器，并在风险交互时弹出解释。总体而言，受试者说当浏览器提醒异常时感觉更安全，而不是只在“安全”时显示，或由浏览器替他们做绝对信任判断并直接阻止。
mholt查看英文原文
My masters thesis [1] was about ways browsers can help protect users from risks involving deception. We concluded that we can't stop attackers from imitating or manipulating UI/UX elements, but we can be clever about how we protect users by being more attentive to their interactions and more focused on subtle cues, rather than codified, absolute allow/block lists. We discussed about how most browser warnings currently fill the page below the line of death in a way that is easy for phishing sites to impersonate. The user can click "Back to Safety" only to be taken to the real phishing page. One of the experiments we conducted was presenting browser warnings above the line of death by replacing security indicators with risk indicators, and even popping-out a warning explanation upon a risky interaction. Overall, subjects reported that they felt safer when the browser alerted them to abnormalities, rather than simply showing them when they were "secure" or having the browser making absolute trust decisions for them by blocking access to a page with a big warning. [1]: https://scholarsarchive.byu.edu/etd/7403/
可信 UI 之战已输，普通用户盲信锁图标，WebAuthn/无密码是主要希望。
参见相关的浏览器套浏览器攻击：……可信 UI 之战实际上已经输了。或者说从一开始就没多大仗可打，因为 UX 研究者在 00 年代到 10 年代发现，普通消费者信任任何带锁图标的东西。WebAuthn 和无密码信任流程是我们阻止钓鱼灾难的最大希望。
miohtama查看英文原文
See the related browser-in-a-browser attack: https://news.ycombinator.com/item?id=30697329 The trusted UI battle has been effectively lost. Or it was not much of a battle in the first place, as an average consumer trusts anything with a lock icon on it, as UX researchers found out in 00s - 10s. WebAuthn and passwordless trust flows are our best hope to stop phishcalypse.
安全 UI 难在低频灾难、妨碍任务、与功能竞争且专家与普通用户感知不同。
“安全 UI 很难”。是的。它结合了让 UI（本来就难）更难的多方面：灾难性后果但（普通用户体验中）罕见；即使做对了也可能妨碍用户工作；与功能特性竞争，有时直接冲突（为什么现在有全窗口 API？因为有用）；领域专家会注意到普通用户注意不到的东西（作者举的 Vista/XP 例子）。
mooreds查看英文原文
"Security UI is hard". Yup. It combines a lot of different aspects that make UI (which is always hard) more difficult: * Catastrophic implications, but rare (in the typical user's experience). How often does the average user get phished or have their account taken over, compared to how often do they have to log in to Random App X to do their job? * Can impede user's job, even when done right. * Competes with functional features, sometimes directly. Why is there now a full window API? Because it is useful. * People who work in the space are experts and will notice things that typical users will not (the example the author gives about Vista/XP)
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选