This message in the developer tools panel on the Instagram site

pawb.social/pictrs/image/1a93a753-fe6a-40b1-b37…

submitted by Avatar Seraphin 🐬 edited

This message in the developer tools panel on the Instagram site

Log in to comment

Avatar gerryflap

Seems like a good idea to put that there. People who know what they're doing won't be bothered by it, but it might save a few people from getting hacked

Blackmist

Yeah, but when a man *really* wants to see some Instagram models private nudes, he'll ignore all those warnings and then some.

You see it all the time with banking, where somebody has literally had the bank ring them up to ask them if they really know the person they're sending money to, and that they think they're being scammed, and they push on regardless getting angry with the bank, only to be all surprise Pikachu in the papers when they are, unsurprisingly enough, scammed.

limelight79

Years ago, when one of those emails with the malicious links was going around (I forget which one), one of our coworkers clicked on it. This one promised pictures of cute kittens. She later said she knew it was fake, but she was hoping she'd still get to see the picture of the kittens...

Avatar Thavron

Honestly if you're going to scam someone with the promise of cute kitten pictures, you could at least look up some pictures.

Rhynoplaz

They just put that there so I can't see the titties!

Honytawk

Just put some ascii tiddies in the code as well

lagomorphlecture

When the cashier at Walmart gets all concerned and asks why you need 50 iTunes gift cards you should stop and think for a second.

ElectricMoose

Hacker: That's ok, we don't want you to paste stuff in there, we just want you to send us your cookies. It's not like you're eating them anyway…

doctorcrimson

Hey once your logged in, can I have that unique identifier over there? It's for science. ;>

tillary

I'm admiring the ASCII art - great usage of different characters to smoothe out the outline of the text

shasta

Probably generated by a bot

doesnt_use_lemmy

Somebody had to program that bot! They still sat down and did the hard work of getting it smooth, but for every character

Avatar Nailbar , edited

Ah, but you can have a bot do that too

adoth

Somebody had to program that bot too!

intensely_human

Not if there's a bot building bot for that

Honytawk , edited

Machine learning though

Avatar Atemu

That would produce a wonky "Sl0p" instead. Great.

Avatar idunnololz

Can confirm

  • is bot
Avatar EdibleFriend

Oh? Let's test this. THIS STATEMENT IS A LIE

*don't think about it don't think about it don't think about it don't think about it*

papalonian

Hmmm.. uh, true, gonna go true on that one.

Arthur_Leywin

But if true then is lie

intensely_human

Generated by a function, come on

gohixo9650

asciiart is decades old https://en.wikipedia.org/wiki/ASCII_art

lurch

reddit had a recruitment ad in it, once

wahming

Now they'll just try and charge you a fee to mess with it instead

Avatar MP3Martin

Discord does that

glibg10b

Firefox has a built-in warning against pasting. I think Chromium too. I don't think they warn about account theft, though.

gornius

Chromium now requires you to type a string inside the console before it lets you paste anything.

glibg10b

Firefox as well:

⚠️ Scam Warning: Take care when pasting things you don’t understand. This could allow attackers to steal your identity or take control of your computer. Please type ‘allow pasting’ below (no need to press enter) to allow pasting.

mvirts

Soon browsers will require you to implement fizzbuzz in the console before enabling paste 😅

Oszilloraptor

Honestly, a Modulo-Captcha wouldn't be that bad of an idea?

Sure, it's not really "non-dev-proof"; but I guess a simple "To enable pasting, please type result to the following formula: 5%3" would at least stop some people that will glady ignore the warning because obviously nobody wants to let you hack other Facebook accounts, but those guys told me it's fine - but will already be confused and then feel smart by entering 0.15 because 5% of 3 is 0.15 ... and wonder why it doesn't work

bamboo

Before you try to enable enable vim mode in Obsidian, you're prompted to show you know how to exit vim before continuing.

brbposting

What would a pasting attack look like and how would it work?

glibg10b , edited

JavaScript can be used to get your password (if you enter it somewhere after pasting) or a session token, which gives an attacker temporary access to your account, unless a website is designed well enough to suspect that the attacker is not you.

Black616Angel

Now what most people don't know is that websites can insert arbitrary text when you copy stuff of them. A malicious site will abuse that.

It works like that:

You follow a tutorial online or search for a code snippet. You copy some code/said snippet and paste it into a terminal or the browser command line. This copied text is altered by the site to be a one line command to install malware or grab passwords or cookies. All of that is followed by a line break and maybe your real command to lower suspicion.

Some of the terminal or browser shells interpret a line break in the copied text as enter which then executes the command.

To prevent that, get a shell, that doesn't just execute what you paste (fish shell) or a terminal program, that warns you about line breaks (Moba xterm).
And please check text from unknown sites before pasting it into a program that may execute it right away. (Just paste it into a text editor or look at your clipboard manager like Win+V in windows)

Avatar Kerb , edited

they even straight up disable pasting until you reenable it.

and both browsers warned about identity theft in the error message when i tried it.

Avatar RobotToaster

Yeah, you see this on a few sites.

/home/pineapplelover

Think discord has it as well

Avatar TheCheddarCheese

discord has it too iirc

spookex

Yep, that's the first place where I saw something like that

Avatar KSP Atlas

Lots of sites have this, I'd assume its common security practice for large sites where scammers are aplenty

Avatar 𝕯𝖎𝖕𝖘𝖍𝖎𝖙

With access to front-end javascript comes great responsibility.

MonkderZweite , edited

But .tsx, i don't know...

Avatar squid_slime , edited

Deleted by author