Forum Moderators: phranque

Message Too Old, No Replies

The DANGER of popup-blockers.

they let your browser do invisible things

         

httpwebwitch

4:45 pm on Jan 23, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



With javascript, you can make a parent window open a new child "popup" window, write an HTML form in that window, submit that form, then close the window. This is all done hands-free, with commands using the DOM, and it can all happen pretty fast.

I created a form that acted just like that. In order to submit stuff to the database without reloading the page, I use a popup form with hidden elements in a new little window. It does the SQL work, then closes. works great.

Then I remembered all the popup blockers out there, and realized that they might hinder this strategy. So I tried doing the same thing with my Googlebar popup block set to "on". I expected nothing to work.

But it did work!

Javascript was able to open a new window, write a form in that window, submit that form, and close the window. The popup blocker only prevented me from SEEING it. The processes still happened, and the data DID show up in my database.

As a developer trying to solve a difficult interface problem, I think it's grand - that's exactly what I hoped would happen! but it reveals to me some potential privacy problems. I don't enjoy the idea of invisible processes going on in windows that seem not to exist.

[edited by: httpwebwitch at 6:06 pm (utc) on Jan. 23, 2004]

txbakers

4:58 pm on Jan 23, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I don't enjoy the idea of invisible processes going on in windows that seem not to exist

Welcome to the wonderful world of spyware, scumware and other assorted crap that gets downloaded from the web without your knowledge.

Download Ad-Aware and run it regularly and you'll be surprised what comes in.