<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 2022-05-31 21:44, Nat Sakimura via
Openid-specs-fapi wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAJcjuEKH7eeJhUORDJ4Qi-y2D=-sTCZ0+ZB3vhuj4OnLH78wJA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">One of the things that I did not adequately address
when designing FAPI 1.0 is the Browser User Interface Hijack
attack. This is happening in real life. In this attack, the
attacker hijacks the user interface of the consumption device
and rewrites the user interface so that the attacker can obtain
a false authorization, e.g., changing the account number to
which money is being sent on the user interface. The user thinks
that it is a legitimate payment to someone he intends, but the
actual payment message is saying that it will go to the
attacker.
<div><br>
</div>
<div>If we address this, perhaps could it be a compelling enough
"feature" that implementation may want to upgrade? </div>
<div><br>
</div>
<div>BTW, this will likely require multi-device authorization
with independent U/I generation mechanisms. Multi-device with
the same browsers with synchronized plug-ins probably will not
work. <br>
</div>
</div>
</blockquote>
<br>
Isn't this addressed by W3C's Secure Payment Confirmation available
in Chromium-based browsers?<br>
<br>
Thanx,<br>
Anders<br>
<br>
<blockquote type="cite"
cite="mid:CAJcjuEKH7eeJhUORDJ4Qi-y2D=-sTCZ0+ZB3vhuj4OnLH78wJA@mail.gmail.com">
<div dir="ltr">
<div>
<div><br>
</div>
<div>Cheers, </div>
<div>-- <br>
<div dir="ltr" class="gmail_signature"
data-smartmail="gmail_signature">
<div dir="ltr">Nat Sakimura
<div>FAPI WG Co-chair</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Openid-specs-fapi mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-fapi@lists.openid.net">Openid-specs-fapi@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="https://lists.openid.net/mailman/listinfo/openid-specs-fapi">https://lists.openid.net/mailman/listinfo/openid-specs-fapi</a>
</pre>
</blockquote>
<br>
</body>
</html>