Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting IndexedDB API information leaks in Safari 15

fingerprintjs.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Exploiting IndexedDB API information leaks in Safari 15

#51

Post by kyriakos »

jmull wrote: post #29
kyriakos wrote: post #10

Earlier quoted context omitted.

Security in this case is broken by actually forcing the browser engine monopoly on ios.

Well, only if the alternatives are, overall, more secure and private than Safari. I tend to doubt that's true, mainly because, by far, the most likely alternative is Chrome, and Chrome is specifically designed to leak its users' personal information to Google's customers (the ones that generate the bulk of their revenue, that is).

The problem is when a zero day is found on safari engine there's no alternative one can use till it gets patched.

Re: Exploiting IndexedDB API information leaks in Safari 15

#52

Post by [deleted] »

mulmen wrote: post #40

I rarely (never?) see Apple engineers posting in these threads. With other big tech organizations some kind of insider insight is occasionally provided. Is Apple’s culture of secrecy that strong? Is it a sense of superiority? Is it embarrassment? Are they just not here? As a mid-career engineer with highly marketable skills and an inbox stuffed with job offers the only two companies I would never entertain an offer f…

[deleted]

Re: Exploiting IndexedDB API information leaks in Safari 15

#53

Post by [deleted] »

sangeeth96 wrote: post #26

How is this not a P1 thing in the iOS/iPadOS/macOS/security teams at Apple? Seriously? Bare minimum, why didn't they let people know about this? We know the whole "we care about privacy" thing is marketing fluff now but holy F this is just unacceptable. And this kind of an issue is exactly why Apple needs to stop screwing around and do the following things ASAP: 1. Decouple Safari from the OS so that it can be update…

[deleted]

Re: Exploiting IndexedDB API information leaks in Safari 15

#54

Post by anony23 »

mulmen wrote: post #40

I rarely (never?) see Apple engineers posting in these threads. With other big tech organizations some kind of insider insight is occasionally provided. Is Apple’s culture of secrecy that strong? Is it a sense of superiority? Is it embarrassment? Are they just not here? As a mid-career engineer with highly marketable skills and an inbox stuffed with job offers the only two companies I would never entertain an offer f…

No post body was provided.

Re: Exploiting IndexedDB API information leaks in Safari 15

#55

Post by evercast »

mulmen wrote: post #48
gleenn wrote: post #46

Earlier quoted context omitted.

Why does (near) silence equate to incompetence?

My perception of Apple’s (software) engineering capabilities comes from being their customer and using their products daily. This might be different if I had some perception of what was happening internally or how problems are approached. But from what I see nobody at Apple cares. So the silence contributes to the perception of incompetence by not counter-acting it.

As engineers, we all know that there are different circumstances. Sometimes they are technical, sometimes political. I would say we should always assume goodwill, unless proven wrong. This is irrespective of whether we talk about Apple, Google, Microsoft, Facebook or any other company.

Re: Exploiting IndexedDB API information leaks in Safari 15

#56

Post by kyriakos »

iqanq wrote: post #9
capableweb wrote: post #5

Earlier quoted context omitted.

What we need are companies working on browsers that actually care about the web. Apple have demonstrated time and time again that they don't, because they favor native applications on iOS and macOS over anything web, so we end up with subpar browsers who ship with the OSes. In some cases (iOS), we even end up with a browser-monopoly where no other browser is even welcome.

It's good that Apple doesn't care about the web, because that means that developers can't rely on the APIs that Apple refuses to implement, meaning that in the end the web ends up with fewer APIs that can be used in practical terms.

Why would you want less api? Overall at the specification level those APIs are secure even if some implementations aren't. Web is a mature application platform at this point and it's being held back by apple.

Re: Exploiting IndexedDB API information leaks in Safari 15

#57

Post by [deleted] »

evercast wrote: post #55
mulmen wrote: post #48

Earlier quoted context omitted.

My perception of Apple’s (software) engineering capabilities comes from being their customer and using their products daily. This might be different if I had some perception of what was happening internally or how problems are approached. But from what I see nobody at Apple cares. So the silence contributes to the perception of incompetence by not counter-acting it.

As engineers, we all know that there are different circumstances. Sometimes they are technical, sometimes political. I would say we should always assume goodwill, unless proven wrong. This is irrespective of whether we talk about Apple, Google, Microsoft, Facebook or any other company.

[deleted]

Re: Exploiting IndexedDB API information leaks in Safari 15

#58

Post by tata71 »

oldsj wrote: post #37
basch wrote: post #23

Earlier quoted context omitted.

Microsoft has to have wrestled some power away with Edge. They have a seat at the table.

Edge is just Chromium now https://finance.yahoo.com/news/microsoft-edge-chrome-chromiu...

Chromium is "just" a logical, security first base OSS project,

that (theoretically) any org can adopt and strap additional modules onto.

Re: Exploiting IndexedDB API information leaks in Safari 15

#59

Post by mulmen »

evercast wrote: post #55
mulmen wrote: post #48

Earlier quoted context omitted.

My perception of Apple’s (software) engineering capabilities comes from being their customer and using their products daily. This might be different if I had some perception of what was happening internally or how problems are approached. But from what I see nobody at Apple cares. So the silence contributes to the perception of incompetence by not counter-acting it.

As engineers, we all know that there are different circumstances. Sometimes they are technical, sometimes political. I would say we should always assume goodwill, unless proven wrong. This is irrespective of whether we talk about Apple, Google, Microsoft, Facebook or any other company.

> As engineers, we all know that there are different circumstances. Sometimes they are technical, sometimes political.

Agree. I'm just curious what it is at Apple. Their hardware seems fine, even excellent. But the software is really not at the same level. So I wonder how that happens.

Re: Exploiting IndexedDB API information leaks in Safari 15

#60

Post by easrng »

parhamn wrote: post #7

It's very interesting seeing exploits like this from this organization. On one hand their service fingerprints users and offers extended metadata like whether the user is in incognito via sketchy web apis. On the other hand they report (and help close) some gnarly exploits like this via sketchy web apis. What do you all make of this? It's hard to not see it as some weird "were not doing a bad thing" gaslighting (perh…

IndexedDB isn't sketchy, just annoying. It is the only semi-reliable way to store more than a few MBs of data with JS, but the API is awful and it's a pain to use without some kind of wrapper to make it bearable. (LocalForage is good, it provides a LocalStorage-like API on top of IndexedDB or some other APIs in older browsers.)
Post reply on HN