3 ms·

With current CPU design there is only so much that can be done, but the architectural fix seems obvious to me, one that doesn't give up the performance benefits

With current CPU design there is only so much that can be done, but the architectural fix seems obvious to me, one that doesn't give up the performance benefits of speculative execution and branch prediction. The data in caches, the TLB, and the state tracked by branch prediction must be segregated by the protected mode bit. That isn't sufficient so solve all the problems, but seems like it solves a number of them.

pizlonator 9y ago
The problem that JSC is dealing with is that Spectre allows untrusted JS code to read things from the memory of the process that runs it. We don't want to allow that, but I don't think your proposed solution would fix it.
- gpderetta 9y ago
  If browsers are careful not to put any sensitive information in the same process that is executing JS code, sandboxing could work. This seems a sensible thing anyway as it would mitigate other attacks as well. Allocating one process for JS-using webpage is expensive though.
  - om2 9y ago
    Chrome is working towards something like this with Site Isolation, and it’s a good idea. Unfortunately it’s not a complete defense. First, web pages can load cross origin resources, and that may be enough to get data or a cookie into the attacker’s web process. Second, some risks of this attack (e.g. ASLR bypass) don’t require any data from another origin to be in process to be dangerous.
    - gpderetta 9y ago
      > web pages can load cross origin resources I know nothing about web technologies, but maybe this is something we should stop doing, at least for any executable resource? This would prevent JS ads I guess, so win/win? > Second, some risks of this attack (e.g. ASLR bypass) don’t require any data from another origin to be in process to be dangerous. yes, ASLR seems to be busted.
      - om2 9y ago
        > > web pages can load cross origin resources > I know nothing about web technologies, but maybe this is something we should stop doing, at least for any executable resource? This would prevent JS ads I guess, so win/win? It's arguably a flaw in the design of the web that loading cross-origin resources is allowed by default. Unfortunately, there isn't a great path to changing this. We may be able to allow websites to opt out of having their resources loaded cross-origin, maybe (similar to X-Frame-Options but for resource types other than frames).
- tasty_freeze 9y ago
  What JSC is doing is addressing a problem that exists in today's CPUs. I'm saying what future CPUs need to do to avoid certain classes of sidechannel attacks. That list isn't sufficient, but if it isn't done it seems like inviting other future attacks.

pizlonator 9y ago

The problem that JSC is dealing with is that Spectre allows untrusted JS code to read things from the memory of the process that runs it. We don't want to allow that, but I don't think your proposed solution would fix it.

gpderetta 9y ago
If browsers are careful not to put any sensitive information in the same process that is executing JS code, sandboxing could work. This seems a sensible thing anyway as it would mitigate other attacks as well. Allocating one process for JS-using webpage is expensive though.
- om2 9y ago
  Chrome is working towards something like this with Site Isolation, and it’s a good idea. Unfortunately it’s not a complete defense. First, web pages can load cross origin resources, and that may be enough to get data or a cookie into the attacker’s web process. Second, some risks of this attack (e.g. ASLR bypass) don’t require any data from another origin to be in process to be dangerous.
  - gpderetta 9y ago
    > web pages can load cross origin resources I know nothing about web technologies, but maybe this is something we should stop doing, at least for any executable resource? This would prevent JS ads I guess, so win/win? > Second, some risks of this attack (e.g. ASLR bypass) don’t require any data from another origin to be in process to be dangerous. yes, ASLR seems to be busted.
    - om2 9y ago
      > > web pages can load cross origin resources > I know nothing about web technologies, but maybe this is something we should stop doing, at least for any executable resource? This would prevent JS ads I guess, so win/win? It's arguably a flaw in the design of the web that loading cross-origin resources is allowed by default. Unfortunately, there isn't a great path to changing this. We may be able to allow websites to opt out of having their resources loaded cross-origin, maybe (similar to X-Frame-Options but for resource types other than frames).
tasty_freeze 9y ago
What JSC is doing is addressing a problem that exists in today's CPUs. I'm saying what future CPUs need to do to avoid certain classes of sidechannel attacks. That list isn't sufficient, but if it isn't done it seems like inviting other future attacks.