4 ms·

To solve this, [...use Service Workers] to install some code which can't be changed without setting off a warning to you. How does that work? Isn't a service w

by krz8 9y ago

To solve this, [...use Service Workers] to install some code which can't be changed without setting off a warning to you. How does that work? Isn't a service worker started by plain JS code?

twiss 9y ago
Yes, it is, but after that, it stays installed and runs before you open the web app the next time. In effect, this makes it trust-on-first use, just like if you'd install a desktop app which then had some secure update mechanism.
- woranl 9y ago
  Can service worker’s code ever be updated by the hacker? How does this actually work?
  - twiss 9y ago
    Yes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2]. Of course, it would be better to only warn the user if the Service Worker changes if it doesn't match the version on GitHub, but that's blocked on [3]. Furthermore, there are some very edge-case situations where the Service Worker can update when Airborn OS is not open or not visible (e.g., in a hidden iframe [4]). That is why, when you register and check "Notify me before updating Airborn OS", it asks you for permission to send you notifications. Those notifications are currently only used to warn you when the Service Worker updates. [1]: https://developer.mozilla.org/docs/Web/API/ServiceWorkerRegistration/onupdatefound https://developer.mozilla.org/docs/Web/API/ServiceWorkerRegi... [2]: http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Apps-using-Service-Worker http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap... [3]: https://github.com/w3c/ServiceWorker/issues/1208 https://github.com/w3c/ServiceWorker/issues/1208 [4]: https://bugs.chromium.org/p/chromium/issues/detail?id=773307 https://bugs.chromium.org/p/chromium/issues/detail?id=773307, but it's not a browser bug. I should file a spec bug, but I'm still waiting for a reply on [3], too.
    - woranl 9y ago
      The concept of Transparent Web Apps (TWA) is an interesting one - more so than AirbornOS itself. Any chance of packaging it (i.e. in the form of library, or make it as a SaaS) to promote adoption? This can enable more TWA and perhaps pivot yourself to become the TWA hub/directory.
      - twiss 9y ago
        Yes, I'm planning to make a library for it. It won't be quite install-and-forget, because the developer has to 1) push to GitHub or another public log before every deploy and 2) somehow let the Service Worker know where to find the latest version on GitHub. But it's definitely possible. A TWA hub sounds interesting. I think that if you have a list of web apps that 1. are a Transparent Web App 2. have had a security audit you could then add some UI in the browser that says "this web app keeps your data private". That would be useful not just for apps that use client-side encryption, but also very simple web apps, like say word counters. It's very useful for users to know whether the word counter sends their data to the server or not. Of course, step 2 would be quite expensive, although for simple web apps it would be manageable. It would have to be financed by either the web apps themselves, or some big entity like Mozilla (which for years has had volunteers manually check browser extensions for things like this, too).
        woranl 9y ago
        The JavaScript trust issue will always be a concern when webcrypto is used, and webcrypto is a web Api expected to be made broadly available across browsers (desktop and mobile). If somehow the concept of TWA can be made easy for developers to adopt and you pivot to handle/streamline the heavy lifting, I think you may have a much more lucrative nitch. Think of this as VeriSign for TWA. Wouldn’t that be cool? Someone (i.e you or Mozilla) should do this. This really promotes the open web.
    - woranl 9y ago
      What if the hacker changes the HTML file to point to their evil version of JavaScript file without ever triggering the Service Worker’s cache? Will that defeat the security feature?

by krz8 9y ago

To solve this, [...use Service Workers] to install some code which can't be changed without setting off a warning to you. How does that work? Isn't a service worker started by plain JS code?

twiss 9y ago

Yes, it is, but after that, it stays installed and runs before you open the web app the next time. In effect, this makes it trust-on-first use, just like if you'd install a desktop app which then had some secure update mechanism.

woranl 9y ago
Can service worker’s code ever be updated by the hacker? How does this actually work?
- twiss 9y ago
  Yes, it can, but whenever the Service Worker's code changes, the user is warned. There's an "updatefound" event [1] which both the web page and the old Service Worker get. I wrote a blog post with more background info at [2]. Of course, it would be better to only warn the user if the Service Worker changes if it doesn't match the version on GitHub, but that's blocked on [3]. Furthermore, there are some very edge-case situations where the Service Worker can update when Airborn OS is not open or not visible (e.g., in a hidden iframe [4]). That is why, when you register and check "Notify me before updating Airborn OS", it asks you for permission to send you notifications. Those notifications are currently only used to warn you when the Service Worker updates. [1]: https://developer.mozilla.org/docs/Web/API/ServiceWorkerRegistration/onupdatefound https://developer.mozilla.org/docs/Web/API/ServiceWorkerRegi... [2]: http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Apps-using-Service-Worker http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap... [3]: https://github.com/w3c/ServiceWorker/issues/1208 https://github.com/w3c/ServiceWorker/issues/1208 [4]: https://bugs.chromium.org/p/chromium/issues/detail?id=773307 https://bugs.chromium.org/p/chromium/issues/detail?id=773307, but it's not a browser bug. I should file a spec bug, but I'm still waiting for a reply on [3], too.
  - woranl 9y ago
    The concept of Transparent Web Apps (TWA) is an interesting one - more so than AirbornOS itself. Any chance of packaging it (i.e. in the form of library, or make it as a SaaS) to promote adoption? This can enable more TWA and perhaps pivot yourself to become the TWA hub/directory.
    - twiss 9y ago
      Yes, I'm planning to make a library for it. It won't be quite install-and-forget, because the developer has to 1) push to GitHub or another public log before every deploy and 2) somehow let the Service Worker know where to find the latest version on GitHub. But it's definitely possible. A TWA hub sounds interesting. I think that if you have a list of web apps that 1. are a Transparent Web App 2. have had a security audit you could then add some UI in the browser that says "this web app keeps your data private". That would be useful not just for apps that use client-side encryption, but also very simple web apps, like say word counters. It's very useful for users to know whether the word counter sends their data to the server or not. Of course, step 2 would be quite expensive, although for simple web apps it would be manageable. It would have to be financed by either the web apps themselves, or some big entity like Mozilla (which for years has had volunteers manually check browser extensions for things like this, too).
      - woranl 9y ago
        The JavaScript trust issue will always be a concern when webcrypto is used, and webcrypto is a web Api expected to be made broadly available across browsers (desktop and mobile). If somehow the concept of TWA can be made easy for developers to adopt and you pivot to handle/streamline the heavy lifting, I think you may have a much more lucrative nitch. Think of this as VeriSign for TWA. Wouldn’t that be cool? Someone (i.e you or Mozilla) should do this. This really promotes the open web.
  - woranl 9y ago
    What if the hacker changes the HTML file to point to their evil version of JavaScript file without ever triggering the Service Worker’s cache? Will that defeat the security feature?