Hi, This may be of some interest to people on the list: http://lcamtuf.blogspot.com/2010/08/on-designing-uis-for-non-robots.html In general, there is a class of UI design problems that trace back to the failure to account for the inherent limitations of human cognition; the specific example exploited by this PoC is the HTML5 geolocation API (supported by most browsers except for Internet Explorer); calls to navigator.geolocation.getCurrentPosition() result in prompts that can be clicked in a timeframe shorter than the minimal latency required to respond to visual stimuli. A whimsical Firefox-specific PoC is: http://lcamtuf.coredump.cx/ffgeo2/ I reported a number of flaws similar to this one between 2005 and 2007 (e.g., https://bugzilla.mozilla.org/show_bug.cgi?id=376473); but it seems that these problems remain endemic to security UIs across all browsers; and the previously implemented workarounds are sometimes removed as a perceived usability roadblock. We probably need to do better, especially as computers get faster; this would not have been nearly as much of an issue ten years ago. Oh well. I have a nice batch of more serious problems in the pipeline, but still waiting on vendors, so that's it for now :-) /mz
