One solution to the UI-spoofing problem is to have a special keypress that will blank out all non-trusted parts of the screen display. See bug 22183 for details. Problem with such a solution is discoverability. The obvious thing would be to trigger the blanking by a menu item instead of by a keypress. But if the menu itself is spoofed, the attacker has control when you click on that menu item and he can chose to blank out whatever portion of the screen display he wants. Another solution would be to have a menu item that tells the user about the keypress. But then if the menu is spoofed, the atacker could have the menu item tell the user the wrong keypress and the spoofed page would capture that keypress and again decide what to blank out. So this is not going to be an easy problem to solve. Assigning to UE for ideas.

reassigning to Patrice for consideration of UE ideas. I agree. This is a tough issue to resolve with a bullet proof solution.

Some ideas: * Special icon in the browser titlebar, click that and get a menu/whatever where you can blank content. The bad thing is that in some situations, on some OSes, you can spoof the titlebar (move window so that real titlebar is not visible, but spoofed is, for example). Full screen mode would also make you vulnerable to spoofing. * Have an icon in the OS toolbar, like on Windows we have the QuickLaunch icon if you have enabled that, and add a menu to blank content there. Again a page could spoof the toolbar in fullpage mode, although the spoofed toolbar would most likely look different.

Keep in mind that I can always spoof a complete window, titlebar and all, by bringing up an image within the content area. Unlike a real window, this window could not be moved outside the original windows content area, so that would be a clue that it is a spoof. But if the user misses that, he could be fooled by the spoofed title bar and we've lost the game.

patricec is no longer working on this. we need to find a new owner if we think we can find a solution.. any ideas?

This should IMHO be WONFIXed and made public. See bug 22183 comment 75 and bug 22183 comment 79.

This bug is about a *potential solution* to a problem that is already public, so making this bug public.