Tried to visit iheartumami.com using my (defensive) browser. The popup is nothing that was generated by the website, but rather an error message of the browser’s own creation. Yet I can see very well that the webpage rendered fine.
Normally if my Auto Overlay Remover extension does not remove a popup, I can force it to run to get rid of the popup. But because iheartumami.com was designed by some obnoxious sneaky motherfuckers, they somehow tricked the browser into falsely believing that it failed to load the page. The browser’s own popup blocks us from seeing the whole page. The user is /forced/ to:
- click cancel, which just loops. The assholes have you re-fetching the page and wasting bandwidth, b/c why would they give a shit about carbon footprints?
- click ok, which leads to yet another popup that demands you enable ads and popups with nothing else rendered, thus defeating the overlay remover.
- or leave it in an tab while viewing another, in which case the page reloads repeatedly non-stop which abuses both the user’s bandwidth and the website’s bandwidth.
This particular assault which somehow abuses our browser’s error detection has become increasingly popular lately.
The circumvention: $ torsocks lynx iheartumami.com. But not useful if pics are important.
I’m undecided on whether the js inventors fucked up on this, but ATM I’m convinced that the browser devs are at fault for giving users no indication that the dialog box is an instruction from the payload and not from the browser itself. It’s an infosec shit-show that users cannot discern a browser msg from a website msg.
We can do better, in principle. Now that I have come to distrust the
confirm()method by iheartumami.com, I would like the granularity to configure my specific distrust for that particular call by that particular js source. When aconfirm()instruction is reached on that site, I would like the js program to be killed. I suppose this would be comparable to controlling perms given to an AOS app.This isn’t exactly a new thing it was pretty common in the late 90s early 00s. They fell out of favor mostly because browsers started blocking them from redirecting and modals were more effective because they didn’t look so generic and it made users trust them more.
Yep, modals were a sneaky AF invention, (even more than popups, IMHO) for your stated reason as well as so many more, in practice. ☝🏼