You're on Google, the 21st century version of AOL
Where Am I? NYTimes or Google?
61–70 of 381 posts
Re: Where Am I? NYTimes or Google?
#62Earlier quoted context omitted.
If Google AMP is acts like a cache of content, then cache poisoning attacks are a concern. How those cached items expire will determine how long an attacker who poisons the cache can serve malicious content.
At that point, wouldn't the approach be to defend from the client side? Namely, we can instruct the client to not trust any content sign by such-and-such keys. This can be done by pushing out a certificate revocation, etc.
This would be pretty cool (remotely revoking signed exchanges), however it's not part of Google's proposal - Unless every previous security consideration about caches is accounted for in SX's, it's probably not safe to start faking the URL bar.
Re: Where Am I? NYTimes or Google?
#63Earlier quoted context omitted.
Being completely against AMP for obvious reasons, I'm personally not against signed exchanges itself, this feature could spawn a whole new class of decentralised and harder to censor web hosting, that sounds like a great addition.
Going to also spawn a whole new class of semi-persistent malicious pages (say created via XSS) that once signed and captured can be continuously replayed to clients until expiration.
Not continuously. The signed content includes an expiration date, which the publisher controls.
This expiration can also never be set more than 7 days in the future.
Re: Where Am I? NYTimes or Google?
#64Earlier quoted context omitted.
I don’t really think Google’s plan is that weird. And it would be amazing for decentralized networks, archiving, and offline web apps. Google can’t just serve nyt.com — they can serve a specific bundle of resources published and signed by nyt.com verified by your browser to be authentic and unmodified.
The plan is bad because google currently tracks all of your activities inside AMP hosted pages site in their support article. Google controls the AMP project and the AMP library. They can start rewriting all links in AMP containers to Google’s AMP cache and track you across the entire internet, even when you are 50 clicks away from google.com.
Publishers who use AMP were already allowing Google to track everything through either Analytics or Ads.
Likewise, AMP pages are mostly accessed from Google search that's already tracked.
Re: Where Am I? NYTimes or Google?
#65Earlier quoted context omitted.
If Google AMP is acts like a cache of content, then cache poisoning attacks are a concern. How those cached items expire will determine how long an attacker who poisons the cache can serve malicious content.
At that point, wouldn't the approach be to defend from the client side? Namely, we can instruct the client to not trust any content sign by such-and-such keys. This can be done by pushing out a certificate revocation, etc.
Certificate revocations do apply to signed exchanges.
Re: Where Am I? NYTimes or Google?
#66If you think this is creepy, wait until you see Menlo Security. That's security for everyone except the user.
Re: Where Am I? NYTimes or Google?
#67Earlier quoted context omitted.
Isn't this basically like a CDN or a PoP cache?
Not exactly. For a CDN to work, the DNS is repointed towards the CDN's servers. In this case, Google is trying to cover-up that Google and not NYTimes is serving the page.
Is NYTimes's use of Fastly also a cover-up?
Re: Where Am I? NYTimes or Google?
#68Earlier quoted context omitted.
+1. The way I think about it is that signed exchanges are basically a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. Instead you just allow distribution of a single resource (perhaps a bundle), in a crytographically verifiable way. Stated another way, with a typical CDN setup the user has to trust their browser, the CDN, and the source. With signed exchange…
It seems like there is a risk that an old version of a bundle will get served instead of a new one by an arbitrary host? Maybe the bundle should have a list of trusted mirrors?
Alternatively super short expiry times. It doesn't seem like it would be that concerning to have another site serving a bundle that was 5 minutes out of date. It doesn't seem like it should be too much load to be caching content every 5 minutes.
Re: Where Am I? NYTimes or Google?
#69Earlier quoted context omitted.
+1. The way I think about it is that signed exchanges are basically a way of getting the benefits of a CDN without turning over the keys to your entire kingdom to a third party. Instead you just allow distribution of a single resource (perhaps a bundle), in a crytographically verifiable way. Stated another way, with a typical CDN setup the user has to trust their browser, the CDN, and the source. With signed exchange…
It seems like there is a risk that an old version of a bundle will get served instead of a new one by an arbitrary host? Maybe the bundle should have a list of trusted mirrors?
There is a publisher selected expiration date as part of the signed exchange which the client inspects. The expiration also cannot be set to more than 7 days in the future on creation. This minimizes, but of course does not eliminate, this risk.
Re: Where Am I? NYTimes or Google?
#70Earlier quoted context omitted.
Not defending that change, but when do you ever need to copy just the domain instead of the full URL?
Always. Main reason I cut something is I want to paste the hostname into a terminal so it can be an argument of whois or dig or traceroute or whatever, in no case have I ever been glad of the scheme prefix.
Isn't more common to paste to a utility that uses the prefix like curl or wget? Or pasting into a chat? Besides all of those tools could just strip out the prefix, while there's no way to add the protocol to a domain name.
More information is strictly superior.