4 ms·
I'm not that savvy with security so I need a little help understanding this. According to the google security blog: > Google Chrome > Some user or customer ac
by tonmoy 9y ago
I'm not that savvy with security so I need a little help understanding this. According to the google security blog:
> Google Chrome
> Some user or customer action needed. More information here (https://support.google.com/faqs/answer/7622138#chrome https://support.google.com/faqs/answer/7622138#chrome).
And the "here" link says:
>Google Chrome Browser
>Current stable versions of Chrome include an optional feature called Site Isolation which can be enabled to provide mitigation by isolating websites into separate address spaces. Learn more about Site Isolation and how to take action to enable it.
>Chrome 64, due to be released on January 23, will contain mitigations to protect against exploitation.
>Additional mitigations are planned for future versions of Chrome. Learn more about Chrome's response.
>Desktop (all platforms), Chrome 63:
> Full Site Isolation can be turned on by enabling a flag found at chrome://flags/#enable-site-per-process.
> Enterprise policies are available to turn on Site Isolation for all sites, or just those in a specified list. Learn more about Site Isolation by policy.
Does that mean if I don't enable this feature using chrome://flags and tell my grandma to do this complicated procedure I (or she) will be susceptible to getting our passwords stolen?
- deleted 9y ago[deleted]
- 013a 9y agoIt probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations enabled by default.
- mintplant 9y agoWould I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?
- londons_explore 9y agoYour OS needs patching, as do any programs which handle secret stuff like passwords, cookies, or tokens and interact with the internet (ie. web browsers).
- tonfa 9y agoWasn't there a PoC for a second issue of js reading memory from its own process? Could potentially be an issue (eg reading data from another website)
- olliej 9y agono
- bpye 9y agoThe OS patch stops you reading kernel space from user space trivially (ie. without eBPF in the Project Zero example). You can still cause leakage from the same context, for example, the V8 JIT can read all of the processes memory, without site isolation that can include data on other web pages, passwords, cookies, etc.