Tabnagging fail?

[mrmeval]

I went looking for information about tabnabbing and found a site that implements the attack.. It's an example site not a malware site.

I personally would like to see it disabled by default but you've done well in delaying it till the tab is clicked. Is it possible to maybe shade the tab red when they pull that crap?

I've set it to 3 to disable it. OK, this failed to work in that it flips trusted or untrusted when unfocused.

Thanks

[Giorgio Maone]

I've set it to 3 to disable it. OK, this failed to work in that it flips trusted or untrusted when unfocused.

If the site uses JavaScript to morph itself when unfocused, the only defense you've got is keeping JavaScript disabled on it.
The "forbidBGRefresh" feature is meant to block the scriptless attack: that's why its default is "1" rather than "3", because blocking background refreshes on trusted sites is pointless since JavaScript has almost infinite ways to pull this attack without refreshing.

[mrmeval]

Drat! Thanks.

I've set it to 3 to disable it. OK, this failed to work in that it flips trusted or untrusted when unfocused.

If the site uses JavaScript to morph itself when unfocused, the only defense you've got is keeping JavaScript disabled on it.
The "forbidBGRefresh" feature is meant to block the scriptless attack: that's why its default is "1" rather than "3", because blocking background refreshes on trusted sites is pointless since JavaScript has almost infinite ways to pull this attack without refreshing.