Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple adds a tracker blocker to desktop Safari

techcrunch.com

Post reply on HN
Print view View original

131–140 of 301 posts

Re: Apple adds a tracker blocker to desktop Safari

#131

Post by tptacek »

justinschuh wrote: post #129
tptacek wrote: post #29

This is great, but unfortunately, until Apple ups its browser security game, Safari is a non-starter. On macOS, switching from any other browser to Chrome is in the top 3 things you can do to materially improve your security in ways that actually matter in the real world.

Just to add some context, on macOS you can look at the seat-belt policy as a rough analog of for basic sandboxing guarantees, where the fewer exceptions you have the stronger your sandbox is. From that perspective, Chrome's policy has around 1/10th the exceptions of Safari. * Safari SB policy: https://trac.webkit.org/browser/webkit/trunk/Source/WebKit2/... * Chrome SB policy: https://cs.chromium.org/chromium/src/cont…

For anyone following, this is Justin Schuh of the Chrome security team (and co-author of TAOSSA, probably still the best book in all of software security).

Another thing Chrome does out of the box that Safari doesn't is U2F.

Still another is Chrome's industry-leading TLS management, including the pioneering of HPKP and the Chrome/Firefox pin list, and the aggressive policing of the WebPKI CAs.

I've been pretty aggressively terse in this thread, because I didn't even realize this was a live argument anymore. Safari is simply not as secure as Chrome, and it's less secure in ways that are meaningful to normal users.

Again: iOS, different story.

Re: Apple adds a tracker blocker to desktop Safari

#132

Post by tptacek »

AlexandrB wrote: post #130
tptacek wrote: post #80

Earlier quoted context omitted.

If you're interested in a detailed answer, read this: https://medium.com/@justin.schuh/securing-browsers-through-i... Then try to work back either Edge's or Chrome's approach to security to specific Safari features and design. The Chrome security team is probably the most sophisticated software security team in the industry (lest you think I'm in the tank for Google, I'd say the iOS platform security team is a close…

> The Chrome security team is probably the most sophisticated software security team in the industry Unfortunately the Chrome security team can't provide the kind of security I care about - security from Google's tracking.

If you don't have the kind of security Chrome provides, then in reality everyone can track you, because all they have to do to own up your machine is get you to look at a web page.

Re: Apple adds a tracker blocker to desktop Safari

#133

Post by om2 »

tptacek wrote: post #120
om2 wrote: post #76

Earlier quoted context omitted.

Safari sandbox isn't identical to Chrome's but it's pretty effective. I don't think your statement is a fair one without qualification. ETA: we'd appreciate info about specific info wrong with Safari's sandboxing. We are definitely looking to improve it.

You work on the Apple Safari team. Are you really saying you feel like Safari's sandbox and anti-exploit features are comparable to those of Chrome? That would be a newsworthy claim.

Safari's sandbox is weaker in some ways and stronger in others. Saying which is overall stronger would be a judgment call. I wouldn't make a claim like that without spelling out at least some of the details.

This subthread is about the sandbox so I'm not sure why you threw in "and anti-exploit features". I'd probably say without qualification that Chrome has better memory corruption mitigations.

I hoped you might have concrete feedback on what aspects of our sandbox we should shore up. We have our own ideas but of course an informed outside view would be valuable.

Re: Apple adds a tracker blocker to desktop Safari

#134

Post by tptacek »

om2 wrote: post #133
tptacek wrote: post #120

Earlier quoted context omitted.

You work on the Apple Safari team. Are you really saying you feel like Safari's sandbox and anti-exploit features are comparable to those of Chrome? That would be a newsworthy claim.

Safari's sandbox is weaker in some ways and stronger in others. Saying which is overall stronger would be a judgment call. I wouldn't make a claim like that without spelling out at least some of the details. This subthread is about the sandbox so I'm not sure why you threw in "and anti-exploit features". I'd probably say without qualification that Chrome has better memory corruption mitigations. I hoped you might hav…

In what ways would you say the Safari sandbox is stronger than Chrome's, on macOS?

How would you compare Safari's anti-exploit technology (allocator hardening, Javascript engine hardening, &c) to that of Chrome? Do you think you do anything better than Chrome does on that front?

Re: Apple adds a tracker blocker to desktop Safari

#135

Post by om2 »

tptacek wrote: post #80
dfischer wrote: post #64

Earlier quoted context omitted.

How is Chrome more secure than Safari on macOS?

If you're interested in a detailed answer, read this: https://medium.com/@justin.schuh/securing-browsers-through-i... Then try to work back either Edge's or Chrome's approach to security to specific Safari features and design. The Chrome security team is probably the most sophisticated software security team in the industry (lest you think I'm in the tank for Google, I'd say the iOS platform security team is a close…

This post has lots of info about Chrome and Edge RCE defenses. Super informative on this front. But is surprising light on detail about what makes their sandbox more robust than Edge's. (I don't know near enough about the Edge sandbox to assess this claim for myself.)

Re: Apple adds a tracker blocker to desktop Safari

#136

Post by TallGuyShort »

gruez wrote: post #87
abc_lisper wrote: post #28

Earlier quoted context omitted.

Check https://panopticlick.eff.org/

Due to how the site takes into account ALL user-agent strings ever collected, it overestimates how unique an user-agent string is. Realistically in a given point in time, there are only a few dozen user-agent strings in widespread use (due to how few bits of information actually gets put into it). Unless you're using a special snowflake browser/operating system you should be fine.

I misspoke when I said it was simply User-Agent - they appear to fingerprinting based on other items such as installed fonts, etc. I believe when they say it's unique, it means, "unique". Not, "reasonably uncommon". And if that's the case, it's been up for years and has never encountered a system exactly like my current one. I'm on a very popular Linux distro used by most of my co-workers at a mid-size company, and I have the same set of work-related plugins installed as all of them, plus LastPass and Ad Block Pro. So not mainstream by any means, but also not going out of my way to be a snowflake, either.

Re: Apple adds a tracker blocker to desktop Safari

#137

Post by gok »

justinschuh wrote: post #129
tptacek wrote: post #29

This is great, but unfortunately, until Apple ups its browser security game, Safari is a non-starter. On macOS, switching from any other browser to Chrome is in the top 3 things you can do to materially improve your security in ways that actually matter in the real world.

Just to add some context, on macOS you can look at the seat-belt policy as a rough analog of for basic sandboxing guarantees, where the fewer exceptions you have the stronger your sandbox is. From that perspective, Chrome's policy has around 1/10th the exceptions of Safari. * Safari SB policy: https://trac.webkit.org/browser/webkit/trunk/Source/WebKit2/... * Chrome SB policy: https://cs.chromium.org/chromium/src/cont…

(Your links are switched)

edit: they're fixed now

Re: Apple adds a tracker blocker to desktop Safari

#138

Post by justinschuh »

gok wrote: post #137
justinschuh wrote: post #129

Earlier quoted context omitted.

Just to add some context, on macOS you can look at the seat-belt policy as a rough analog of for basic sandboxing guarantees, where the fewer exceptions you have the stronger your sandbox is. From that perspective, Chrome's policy has around 1/10th the exceptions of Safari. * Safari SB policy: https://trac.webkit.org/browser/webkit/trunk/Source/WebKit2/... * Chrome SB policy: https://cs.chromium.org/chromium/src/cont…

(Your links are switched) edit: they're fixed now

Indeed. Fixed now, and thanks for letting me know.

Re: Apple adds a tracker blocker to desktop Safari

#140

Post by MBCook »

eugeniub wrote: post #123
jacobolus wrote: post #62

Earlier quoted context omitted.

I think he’s referring to aggregated anonymized usage data, which people can opt in or out of with no effect on function. (This is different than messages, etc., which are stored on Apple’s servers but end-to-end encrypted.)

Messages are not currently stored on Apple servers unless you enable iCloud backup.

As of today they will be! And synced across devices.

Hooray.

(still encrypted)

Post reply on HN