3 ms·
You still can insert external image into a page and poll its size either directly or detect it via layout changes. Maybe the root problem lies in HSTS and brow
by codedokode 11y ago
You still can insert external image into a page and poll its size either directly or detect it via layout changes.
Maybe the root problem lies in HSTS and browsers using HTTP by default (because that is why we need HSTS)?
- devit 11y agoIndeed, should disallow that as well, e.g. give such external images and videos an intrinsic size of 1/3 the browser window size regardless of their actual size. And disallow (non-CORS-allowed) cross-domain JavaScript and CSS.
- codedokode 11y agoIt would be easier to disallow http-only CSP though.
- dgoldstein0 11y agothis sounds like a good idea. I do have to wonder if you use CSP & https for your own site (because what site deploys CSP without deploying https first?), what sort of http-only directives would even be legal (i.e could successfully load content) under mixed-content rules. But I don't think this solves the whole problem, as the time to "redirect + load https image" v. "HSTS redirect + load https image" is probably significant enough of a difference to timing attack. In which case you just need to time the onload of an image (or similar resource).
- codedokode 11y agoCSP can be useful on HTTP-only sites to prevent and log XSS attacks (e.g. somebody trying to insert a script on a page via vulnerable server script). That is SCP primary purpose IIRC.
- dgoldstein0 11y agochanging the intrinsic size of an image sounds like a "break the web" sort of change. I'm imagining all the super blurry photos / gifs / etc. that will result, and not liking the thought.