Exploiting IndexedDB API information leaks in Safari 15 • Hacker News Board

Re: Exploiting IndexedDB API information leaks in Safari 15

#11

Post by toomuchtodo » Sat, Jan 15, 2022, 4:37 PM UTC

parhamn wrote: post #7

It's very interesting seeing exploits like this from this organization. On one hand their service fingerprints users and offers extended metadata like whether the user is in incognito via sketchy web apis. On the other hand they report (and help close) some gnarly exploits like this via sketchy web apis. What do you all make of this? It's hard to not see it as some weird "were not doing a bad thing" gaslighting (perh…

Managing the Overton window and anchoring wrt browser tracking.

Re: Exploiting IndexedDB API information leaks in Safari 15

#12

Post by davidatbu » Sat, Jan 15, 2022, 4:37 PM UTC

Is it usual to disclose (what appears to me to be) a vulnerability with massive potential for exploitation towards disastrous ends, before the developers of the software have shipped a fix?

I guess I'm curious as to what the norms are around disclosure of such discovered vulnerabilities are in general.

Re: Exploiting IndexedDB API information leaks in Safari 15

#13

Post by cmsj » Sat, Jan 15, 2022, 4:38 PM UTC

fabian2k wrote: post #8

The way they describe the behaviour when the dev tools are used with undeletable database copies being created, this just looks like the whole area is buggy. Which is of course not an excuse for this, but might also indicate that there could be even more attack surface there.

it's almost like allowing websites to silently create databases on our computers, was a bad idea.

Re: Exploiting IndexedDB API information leaks in Safari 15

#14

Post by eyelidlessness » Sat, Jan 15, 2022, 4:40 PM UTC

iqanq wrote: post #3

What the web needs is fewer APIs.

I mean, I’m not agreeing or disagreeing (and I’ve felt both ways depending on context and mood), but it’s not like this is an exceptionally new API.

Re: Exploiting IndexedDB API information leaks in Safari 15

#15

Post by cmsj » Sat, Jan 15, 2022, 4:40 PM UTC

capableweb wrote: post #5

iqanq wrote: post #3

What the web needs is fewer APIs.

What we need are companies working on browsers that actually care about the web. Apple have demonstrated time and time again that they don't, because they favor native applications on iOS and macOS over anything web, so we end up with subpar browsers who ship with the OSes. In some cases (iOS), we even end up with a browser-monopoly where no other browser is even welcome.

What we need is the web to stop coalescing ever more tightly around Google.

Apple's iOS browser monopoly is literally the only thing preventing Google from having a near total monopoly on web standards.

Re: Exploiting IndexedDB API information leaks in Safari 15

#16

Post by baybal2 » Sat, Jan 15, 2022, 4:41 PM UTC

iqanq wrote: post #3

What the web needs is fewer APIs.

I fully support you. Now, getting rid of obsolete, and dead APIs, and features is way more important than adding new ones.

I can recall a dozen of XSLT implementation bugs which were in Chrome from day 1.

XSLT is not going anywhere from browsers, but they also cannot be fixed, because there is so few people using XSLT today to raise above the noise floor for WebKit devs.

Re: Exploiting IndexedDB API information leaks in Safari 15

#17

Post by agys » Sat, Jan 15, 2022, 4:43 PM UTC

What a mess Safari has become. It used to be my preferred browser for navigating AND developing but it has become less and less appealing, especially for the latter (I submitted several bugs to webkit, but my love is fading).

Re: Exploiting IndexedDB API information leaks in Safari 15

#18

Post by gwill » Sat, Jan 15, 2022, 4:44 PM UTC

keewee7 wrote: post #2

The IndexedDB API in Safari has been buggy and unstable for a very long time.

new bugs all the time too. in iOS 13 i found a bug where getting data from a store by key would ignore whatever store you pass it, so it would return data from every store that matched the key.

Re: Exploiting IndexedDB API information leaks in Safari 15

#19

Post by eyelidlessness » Sat, Jan 15, 2022, 4:44 PM UTC

capableweb wrote: post #5

iqanq wrote: post #3

What the web needs is fewer APIs.

What we need are companies working on browsers that actually care about the web. Apple have demonstrated time and time again that they don't, because they favor native applications on iOS and macOS over anything web, so we end up with subpar browsers who ship with the OSes. In some cases (iOS), we even end up with a browser-monopoly where no other browser is even welcome.

Apple has been rapidly addressing shortcomings in WebKit and significantly expanding its team over the last year (at least). They’re clearly investing, so they clearly care in that sense. It’s also obvious that that rapid pace and onboarding could produce defects. But I don’t think it’s accurate at all to say they don’t care about the web.

Re: Exploiting IndexedDB API information leaks in Safari 15

#20

Post by kitsunesoba » Sat, Jan 15, 2022, 4:45 PM UTC

cmsj wrote: post #13

fabian2k wrote: post #8

The way they describe the behaviour when the dev tools are used with undeletable database copies being created, this just looks like the whole area is buggy. Which is of course not an excuse for this, but might also indicate that there could be even more attack surface there.

it's almost like allowing websites to silently create databases on our computers, was a bad idea.

It would seem I’m not alone in thinking that many web features are too implicit. “Dialog fatigue” or “ok-click syndrome” are real problems, but for many features I think the correct behavior is probably not a silent grant. Anything that consumes the user’s resources after navigating away from the page should probably require direct user consent in some form or another.