3 ms·
Section 3. Security Considerations "Clients SHOULD ignore the immutable extension from resources that are not part of an authenticated context such as HTTPS. A
by IncRnd 9y ago
Section 3. Security Considerations
"Clients SHOULD ignore the immutable extension from resources that are not part of an authenticated context such as HTTPS. Authenticated resources are less vulnerable to cache poisoning."
This must NOT read SHOULD. It must read MUST! Otherwise, your computer will be subject to an executable planting vulnerability.
I'm surprised they don't have a much larger list of security considerations. There are many other issues that can happen.
- jlgaddis 9y agoIf "an authenticated context such as HTTPS" isn't being used -- regardless of the presence of this extension -- isn't your computer already "subject to an executable planting vulnerability"?
- IncRnd 9y agoMaybe. That isn't exactly true. This adds the ability to persist a new threat. There is a temporal difference. An attacker may wish to plant something today, in a coffee shop, that would execute in a protected environment, tomorrow. Immutability of caching can only help an attacker. Yes, there are other ways for an attacker do this, but there is no reason to add to more ways! That's why the web is in its current state. I see how you put "executable planting vulnerability" in quotes. Sometimes (in the current marketing), these are called APTs, but they have been around forever. e.g. Think of dll planting in Windows and the millions of attacks and three or four new API sets from Microsoft that resulted from that single ability to plant a dll in the search path. This type of persistence can also be called incubation.