That's a really well-explained and clearly presented writeup of the bug and how it can be exploited as a vulnerability.
I discovered a browser bug
21–30 of 137 posts
Re: I discovered a browser bug
#22Re: I discovered a browser bug
#23The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.
product-security@apple.com is the real one these days.
Of course, this gets me thinking, what kind of super powers do these addresses have that allows people to send potentially malicious things there to be disassembled and analyzed? I suspect they are quarantined in some way, but it would be interesting to hear from the ops sec crowd how this gets handled.
Re: I discovered a browser bug
#24Earlier quoted context omitted.
But what about applications that link to web pages or web pages that link to applications? What valid reason is there to have an "application" and any documentation or related HTML material from the same site on different ports? Or, as some have pointed out elsewhere when this has come up, to have "applications" and "documents" use completely different protocols, languages and native clients, when both are often used…
'Application' can be backward compatible with documents just fine. That does not mean a new category 'Document' that has reduced capability is useless. Banking websites for example don't need to be Applications and added protection for cross-site scripting etc. would be beneficial. Restrict things further and you default to supporting screen readers etc.
What definitions of "application" and "document" are being used here? Banking websites are applications in terms of their functionality - they're certainly not documents. At least not the parts where I can access and modify my account.
Re: I discovered a browser bug
#25> Lol no.
That hurts, Jake :(
Re: I discovered a browser bug
#26> Lol no. That hurts, Jake :(
bwhahahaha
Re: I discovered a browser bug
#27Earlier quoted context omitted.
That hardly helps. For true security devote a device purely to banking. Preferably a diskless device running an updated live CD on a security oriented distro with no rewritable storage attached connecting out over a VPN through an equally dedicated firewalled router. Then you're just left to worry about your bioses getting infected off an unpatched or 0d exploit.
He identified his threat model (other tabs + addons doing something shady) and made a security assessment based off of it. You're here bullshitting that he needs "true security" like he's dealing with APTs trying to access his bank account. He's not. He's concerned about other tabs + addons, and private browsing mode is a solution with the slightest friction for his threat model. Please, in the future, try making sec…
This was pretty confusing to read until it came to my mind that "threat model" exists :)
Re: I discovered a browser bug
#28I can echo his experience reporting browser bugs and provide my own reviews:
Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick.
Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems.
Chrome - Somewhat of a mixed bag. Some times responses are quick, some times they are from engineers. But most often I get replies that convey the person I'm speaking too is a very green QA type. I've gotten replies that the test case I provided them doesn't reproduce the bug, because they had attempted loading it with the file:// protocol (of course hardly anything works with the file protocol). I'm not sure, do they expect me to include a web server for them?
Safari - Only tried a couple of times, never gotten a whisper back.
I would rate my experiences as:
Firefox - A+
Chrome - C
Edge - D
Safari - F
Re: I discovered a browser bug
#29Earlier quoted context omitted.
'Application' can be backward compatible with documents just fine. That does not mean a new category 'Document' that has reduced capability is useless. Banking websites for example don't need to be Applications and added protection for cross-site scripting etc. would be beneficial. Restrict things further and you default to supporting screen readers etc.
What definitions of "application" and "document" are being used here? Banking websites are applications in terms of their functionality - they're certainly not documents. At least not the parts where I can access and modify my account.
Client side code including third party media players etc.
IMO it's a simple question 'can you do the same thing with a sheet of printed paper.' I can fill out paper forms and hand them to someone just fine. Don't forget a Check is really just a piece of paper with a form on it.
Re: I discovered a browser bug
#30I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…
Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server.
If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.