[teleclimber]

This shows very clearly why browser warnings (aka "permission infobars") that are embedded on the page are bad.

http://chromespot.com/wp-content/uploads/2014/02/screen_quot...

By getting the user accustomed to seeing browser warnings and info there, you make it impossible for them to distinguish a legit browser warning from a fake one crafted by an unscrupulous site owner.

Browser warnings and notifications should significantly overlap the browser chrome (embedded in the address bar for example) so that no web page can make something that looks like it.

edit: image link

[nollidge]

Similarly, this is a major problem with Chrome showing settings in a browser page.

[cal2]

Thanks for bringing these two things to my attention. It's incredible what I can overlook in tools I use everyday. I love it when I learn something new though!