Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blink - Intent to deprecate: Insecure usage of powerful features

groups.google.com

Post reply on HN
Print view View original

31–40 of 96 posts

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#31

Post by TazeTSchnitzel »

bd wrote: post #20

Uhm, I strongly disagree with making fullscreen https only feature. For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps. And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site: http://feross.org/html5-fullscreen-api-attack/ In every browser I tried it was already obvio…

Well, fullscreen wouldn't have to be HTTPS-only, just the permission wouldn't persist for HTTP.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#32

Post by thomasfoster96 »

TazeTSchnitzel wrote: post #25
thomasfoster96 wrote: post #2

Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost. Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non-HTTPS access to powerful api are completely reasonable steps to take. [0] htt…

What about HTTPS for local testing, though?

Reading through the W3C draft linked to in the announcement, localhost over HTTP will be considered probably secure.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#33

Post by JustGotHere »

shangxiao wrote: post #23
bd wrote: post #20

Uhm, I strongly disagree with making fullscreen https only feature. For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps. And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site: http://feross.org/html5-fullscreen-api-attack/ In every browser I tried it was already obvio…

The point of that article was that people don't notice subtle changes, especially when their not tech savvy/tired after a long day of work/whatever. Also someone pointed out in the comments that some people tend to ignore changes and click on whatever to get to their destination.

And article is ignoring that the site can then add https and do that fullscreen attack anyway.

A better solution would be to keep showing a message telling you it has gone fullscreen like browsers currently do.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#35

Post by bd »

shangxiao wrote: post #23
bd wrote: post #20

Uhm, I strongly disagree with making fullscreen https only feature. For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps. And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site: http://feross.org/html5-fullscreen-api-attack/ In every browser I tried it was already obvio…

The point of that article was that people don't notice subtle changes, especially when their not tech savvy/tired after a long day of work/whatever. Also someone pointed out in the comments that some people tend to ignore changes and click on whatever to get to their destination.

Yes, that's true. But for people who don't notice changes there isn't much help anyways.

Even much more primitive phishing will still work on them (just think about those "you have virus / clean your computer" ads from past, with images looking like Windows pop-ups, or remember how those "Nigerian prince" scams intentionally use broken English to selectively address more gullible folks).

These new proposed security measures will not help those people much, they can still be phished from within browser tab content rectangle.

Instead these changes will just basically kill whole class of web applications for a benefit of small subset of population phishable enough with fullscreen attacks but immune to content rectangle attacks.

-----

BTW recent Lenovo Superfish fiasco has shown us that in fact you can't even trust native browser security UI elements. Those real UI green locks on https pages can be as misleading as those JS/HTML generated ones.

I would much more prefer browsers to secure me from known rogue certificates attacks than from hypothetical hard-to-pull-off fullscreen phishing attacks.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#36

Post by TazeTSchnitzel »

thomasfoster96 wrote: post #32
TazeTSchnitzel wrote: post #25

Earlier quoted context omitted.

What about HTTPS for local testing, though?

Reading through the W3C draft linked to in the announcement, localhost over HTTP will be considered probably secure.

Make sense: if you can run a web server, you don't need the browser's help to do a phishing attack.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#37

Post by vertex-four »

jpgvm wrote: post #9

Though only tangentially related I do wish EME had been properly shot in the head. It's just another Flash that hides behind being "html5" (as if they makes it all ok). At the end of the day it's proprietary code executing on my machine that I have little or no control over. It's not just a security risk, it's also a stability concern and generally a terrible idea. Copyright enforcement should be left to law, content…

> Copyright enforcement should be left to law

You would prefer that all copyright violation is a criminal matter rather than a civil one?

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#38

Post by matthewmacleod »

bd wrote: post #20

Uhm, I strongly disagree with making fullscreen https only feature. For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps. And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site: http://feross.org/html5-fullscreen-api-attack/ In every browser I tried it was already obvio…

For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps.

I don't really understand why this is the case — surely they'd just serve them over HTTPS and be done with it?

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#39

Post by RyanMcGreal »

thomasfoster96 wrote: post #2

Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost. Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non-HTTPS access to powerful api are completely reasonable steps to take. [0] htt…

How will Let's Encrypt be different/better than a StartSSL Free certificate?

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#40

Post by kevincennis »

jpgvm wrote: post #9

Though only tangentially related I do wish EME had been properly shot in the head. It's just another Flash that hides behind being "html5" (as if they makes it all ok). At the end of the day it's proprietary code executing on my machine that I have little or no control over. It's not just a security risk, it's also a stability concern and generally a terrible idea. Copyright enforcement should be left to law, content…

I view EME as sort of a necessary evil.

There was never any chance that large content companies were going to be okay with serving unencrypted media over HTTP. So the choices were:

1. No major film or television content on the web

2. The survival of Flash/Silverlight

3. EME

I'm not crazy about any of those choices, but #3 seems the most reasonable.

Post reply on HN