Subject: (DocOz Video) Lose 4X more ...

From: Slip into Skinny Jeans <[email-masked]>
Date: Mon, 18 Aug 2014 12:04:53 -0700

Tv Show: "Get Skinny once and For All"
Special Spring Edition

Soo.... In a perfect world our metabolism would be untouchable 
and we would never have to worry about unwanted -gain.

But in reality our metabolism can be affected by stress,
genes and sleep deprivation. If you find yourself making a 
number of changes but still not noticing a difference ...

Doc Oz has found a way for you to melt fat regardless of what you
-related issues you have had in the past. 

> DocOz Episode Clip > http://www.worndress.com/carb/blocker/oz.video

.................
What the Future Plan Looks Like
.................
Breakfast: Keep the Same
Lunch: Keep the Same 
Dinner: Keep the Same 
** View 1 thing you have to change here: http://www.worndress.com/carb/blocker/oz.video

< G4D Group > Message Settings 
- 3801 D o w n s  W a y  Garland, TX 75040
http://www.worndress.com/o9hh/fhw.fju49 

I am doing a website for a Women's Abuse Resource Center. A lot of centers like this have what is referred to by the centers as a "Panic Button". An example of a basic one is found here at the top of every page in the green bar.

The idea of the link or button is for if a women was looking at this website for help, and their abuser or someone they didn't want to know walked in the room, it allows for a fast escape. Sometimes a link is much faster then closing a browser window and that can be suspicious.

The problem I see is that most buttons I see doing this just send you to google or something like that. I am going to do something like this:

<a href="http://www.msn.com/#news" rel="noreferrer">LEAVE WEBSITE NOW</a>
or

<a href='data:text/html;charset=utf-8, <html><meta http-equiv="refresh" content="0;URL='http://www.msn.com/#news/'"></html>'>LEAVE WEBSITE NOW</a>
A link like that will scroll you to some actual content. Its not a blank Google search but is also not a very specific thing that could be seen as suspicious.

I know that blocking the referrer is good but even with that solution you can hit the back button on your browser and your caught. For this problem I thought I could do something this:

HTML

<a href="javascript:goNewWin()" rel="noreferrer">LEAVE WEBSITE NOW</A>
JavaScript

function goNewWin() {
    window.open("backbuttonnewpage.html",'TheNewpop','toolbar=1,location=1,directories=1,status=1,menubar=1,scrollbars=1,resizable=1'); 
    self.close()
}
I am posting because there are lives at risk with this and I need something that is as close to a total solution as can be. How would you do this?

UPDATE- 3-26-14:
I ran some of the educational ideas posted here by the resource center I am working with and here was their answer. "It takes extreme courage for our users to even come on our website. When they come they are looking for a fast easy resource to get out of a possibly life threatening situation. They would not have the time or the mental capacity in most cases to educate themselves on a safe way to browse our website. When presented with the idea of a "panic button", when done properly, has seemed to be a resource that is always asked for by most victims that we treat."

After reading a lot of the ideas here it seems like a total solution would be a large button that floats in a constant position on left hand side. When the page loads it loads another site in the background (maybe an ajax call) so that clicking the button just removes the overlaying frame. This will mean no load time when clicked. To avoid a back button press of the browser it seems like telling the browser not to cache is necessary as well as possibly using replaceState on every page change to disable a back button that reveals this site.

This is still very much a technical question. The debate helps very much but I still need a working technical solution. Anyone think they are able to get all these ideas together into something functional? Ill be working on it right away myself and will post anything I come up with. Thanks all.
I put an example on my AWS instance at 54.186.79.95 Go to that page, click the button, visit another page, then hit back, you're now on 54.186.79.95/decoywebsite and there's no record of you being on 54.186.79.95/, if cache is disabled, your server will see the "../decoywebsite" request and send a decoy page. Unfortunately, you can't modify the entire domain so you would need the domain to be not suspicious.

If you want to get rid of the page content, I believe the best way is to use document.body.innerHTML='';. You are still technically on the page but all the content is gone.

Next step is to modify your browser history. window.history.replaceState (link to docs) is an HTML5 feature that can modify your history without doing a page reload or a request to your server. It's pretty fast but only works on modern browsers. When the user clicks the panic button, we will replace the current page in his history with a fake url.

If the abusive user clicks back, your server (Php, python, whatever) will receive a request with your fake url. So you need to have another endpoint in your server (Let me know if you don't understand endpoints). Make a benign article, recipe, or weather report with a similar look and feel to your original website in order to avoid suspicion if the abuser got a quick glance at the website. Also make sure the browser's doesn't cache by using the <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">tag.

Additional Remarks

Ideally your entire website (except your decoy article of course) should be an SPA (Single Page Application) so that it only ever produces one browser history record and you only have to modify that one.
At the end of the day, I don't think you can't make a panic button that's 100% foolproof, there's gonna be ways around it. You just have to find one with an acceptable level of security and convenience.
ANOTHER ALTERNATIVE: LOCALLY CHANGE THE INCRIMINATING INFO AND MODIFY BROWSER HISTORY
I was also thinking if instead of loading google, if it's not best to actually transform your site locally with innocent info. This looks less suspicious than loading google (everyone does that) and you can do it all locally without reloading the page.When they click the panic button, you do some fast (and cross-browser compliant) DOM manipulation to change the incriminating info on your website and make it look innocent (maybe just change the text, it has to be fast). This way, it's all done locally which in the vast majo
javascript htmlshare|improve this question3I would start by either clearing or obscuring the current page (using javascript) when the link is clicked (because it can take some time for a link to be followed...)   Cameron Mar 26 at 0:057Interestingly, in the linked page, the "click here to leave quickly" link seems inaccessible on iPad, obscured by social media buttons...about the worst ux decision I've seen in recent history :/   David Thomas Mar 26 at 0:20Agree with David Thomas about preference w/ default to google -- using MSN would by itself be suspicious in my house.   Stephen P Mar 26 at 0:22What is your actual question?   Petah Mar 26 at 0:35Putting the button at the top seems like an awful placement. Think about fitts' law You have a thin strip that somebody has to hit, and if they overshoot they won't hit it. Ridiculous. Put it on the left, where the majority of users can take advantage of the effectively infinite size. (Right could be scrollbar on some displays, bottom is d
 efault taskbar, top is default tab bar. Anybody savvy enough to have changed these defaults probably knows ^w)   Phoshi Mar 26 at 15:55