Feature request/suggestion to combat "tabjacking"

[carl_oz]

Hi there,

Just read on the Register about an attack which targets people who open a lot of tabs - essentially,
an attacking website page presents content as expected until a script detects that it's been unfocused for a
while, whereupon it re-writes its content and url icon to resemble a likely online service like gmail or
facebook (possibly based on guess from browser history or what have you).

A person with multiple tabs, the attacker hopes, won't notice the tab content change and will
assume it's genuine when they next look at that tab. It's expected that the fake content will
capture login details and then pass through to the genuine service, leaving the user none the
wiser.

My suggestion for NoScript is simple enough - have an option to revoke _temporary_ permissions on
de-focus - ideally without the usual page refresh associated with turning scripts on/off.
Permanent permissions could be regarded as trusted, or maybe make this behaviour
separately switchable for temporary and permanent permissions, with the default being
to suspend temp. permissions on defocus.

Apologies if this has already been done or considered - I did try looking through the
recent release notes and searching the forums, but only fairly quickly.

Regards,

Carl Williams

[therube]

A New Type of Phishing Attack