This message in the developer tools panel on the Instagram site
This message in the developer tools panel on the Instagram site
Seems like a good idea to put that there. People who know what they're doing won't be bothered by it, but it might save a few people from getting hacked
168Yeah, but when a man really wants to see some Instagram models private nudes, he'll ignore all those warnings and then some.
You see it all the time with banking, where somebody has literally had the bank ring them up to ask them if they really know the person they're sending money to, and that they think they're being scammed, and they push on regardless getting angry with the bank, only to be all surprise Pikachu in the papers when they are, unsurprisingly enough, scammed.
31When the cashier at Walmart gets all concerned and asks why you need 50 iTunes gift cards you should stop and think for a second.
8
I'm admiring the ASCII art - great usage of different characters to smoothe out the outline of the text
154Probably generated by a bot
23Generated by a function, come on
7asciiart is decades old https://en.wikipedia.org/wiki/ASCII_art
3
Hacker: That's ok, we don't want you to paste stuff in there, we just want you to send us your cookies. It's not like you're eating them anywayā¦
71Hey once your logged in, can I have that unique identifier over there? It's for science. ;>
13
Yeah, you see this on a few sites.
51Think discord has it as well
4
reddit had a recruitment ad in it, once
44Now they'll just try and charge you a fee to mess with it instead
22Discord does that
5
Firefox has a built-in warning against pasting. I think Chromium too. I don't think they warn about account theft, though.
34Chromium now requires you to type a string inside the console before it lets you paste anything.
15Firefox as well:
ā ļø Scam Warning: Take care when pasting things you donāt understand. This could allow attackers to steal your identity or take control of your computer. Please type āallow pastingā below (no need to press enter) to allow pasting.
29
What would a pasting attack look like and how would it work?
4JavaScript can be used to get your password (if you enter it somewhere after pasting) or a session token, which gives an attacker temporary access to your account, unless a website is designed well enough to suspect that the attacker is not you.
9Now what most people don't know is that websites can insert arbitrary text when you copy stuff of them. A malicious site will abuse that.
It works like that:
You follow a tutorial online or search for a code snippet. You copy some code/said snippet and paste it into a terminal or the browser command line. This copied text is altered by the site to be a one line command to install malware or grab passwords or cookies. All of that is followed by a line break and maybe your real command to lower suspicion.
Some of the terminal or browser shells interpret a line break in the copied text as enter which then executes the command.
To prevent that, get a shell, that doesn't just execute what you paste (fish shell) or a terminal program, that warns you about line breaks (Moba xterm).
And please check text from unknown sites before pasting it into a program that may execute it right away. (Just paste it into a text editor or look at your clipboard manager like Win+V in windows)9
they even straight up disable pasting until you reenable it.
and both browsers warned about identity theft in the error message when i tried it.
3
With access to front-end javascript comes great responsibility.
23discord has it too iirc
19Yep, that's the first place where I saw something like that
5
Lots of sites have this, I'd assume its common security practice for large sites where scammers are aplenty
15
But .tsx, i don't know...
2