What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?