“I’m going to screw with your computer. OK?”

I have never understood why JavaScript is allowed to completely block any further user interaction. The correct options that a browser should display when throwing up an alert box are “Okay” and “Never run Javascript on this page/site again.” And they should not block the entire browser in any case—as I write this, Safari and Chrome still allow alerts to block all windows¹. In the modern world of tabs and multiple windows, letting a single web page block other web pages is a throwback to the stone age.

Click here for a non-binding example. The machine should call you an asshole, and there’s nothing for you to do except agree. That’s unacceptable.

Click here for an example that will lock up some browsers (save your work first!). Once you kill your browser and restart, realize that I didn’t have to give you the option of choosing that behavior: I could have forced it on you as soon as you visited the page. That’s ridiculously unacceptable.

I’m not the first to ask this question. Veeti Paananen asked it at the beginning of 2009. Raymond Camden asked it in 2007, and in the comments people wondered how it could be a security issue.

This was before the MacDefender trojan that infected web advertising servers and image searches several months ago. Part of the reason MacDefender worked is that it couldn’t be ignored. People who are confused about what action to take are perfectly happy to ignore a problem until it goes away; the alert box took that option away from them. The JavaScript alert meant that they couldn’t ignore it until it went away. It was a social engineering attack to get victims to run the downloaded trojan, and it apparently was pretty successful.

Safari is the worst of all of the browsers I tested writing this: alerts will block all windows, windows can’t be closed, and it will never offer the option of canceling the script. I can’t open new windows or tabs, and am stuck until I decide how to deal with the offending alert. That all helped MacDefender get its job done.

Opera lets you stop suspicious alerts immediately.

Firefox will present a checkbox to block all further alerts on this page if I hit the “Okay” button ten times, but by then the social engineering attack has already done its job. That checkbox needs to be there on the very first alert, to let people know that this alert is not official, but is rather an untrusted message from an untrusted source. On the plus side, Firefox allows me to close the blocked window without touching the alert box.²

Chrome puts the checkbox on the second alert, rather than the tenth; that’s still too late. To be effective, that checkbox needs to be there on the very first alert. MacDefender didn’t need a second alert to do its job; all it needed was to get the victim to say “OK” once to let their guard down or resign them to doing whatever they thought it was doing. Chrome does not allow closing the tab/window while the alert is there.

Opera is the only one of the four that works correctly. It puts the checkbox for blocking further JavaScript³ on the first alert, and it makes it clear that the alert is not something from the browser but from outside. Opera’s alerts don’t block anything except the current page. The current page can even be closed without touching the alert box.

Of course, MacDefender also made use of the auto-download feature that is still available in most browsers. If you’ve ever been on a page that says “your download will begin in x seconds”, and the download does, in fact, begin, then your browser is also susceptible to this.