5 ms·

oh wow, Signed Exchanges are worse than AMP! "make sure you are visiting mybanksite.com" is no longer safe.

by buboard 7y ago

echeese 7y ago
How is it no longer safe?
- buboard 7y ago
  Phishing
  - echeese 7y ago
    They can't alter the content - that's where the 'signed' part comes in. Any forms there would still go to the original source.
JohnFen 7y ago
I don't think there's a real phishing risk with them, but I object to Signed Exchanges because they are actively making the browser lie to me about the URL being used.
- Ajedi32 7y ago
  The URL the browser shows is the one which was cryptographically verified to be correct. I don't see how you can call that a "lie". If I'm offline and I open an offline cached page in my browser, would you call it a lie if the browser displays the URL I originally downloaded that page from in the URL bar instead of saying it came from "your hard drive"?
  - tyingq 7y ago
    It's not just us HN commenters that are concerned. Mozilla, for example, is highly opposed to it in it's current state. "Mozilla has concerns about the shift in the web security model required for handling web-packaged information. Specifically, the ability for an origin to act on behalf of another without a client ever contacting the authoritative server is worrisome, as is the removal of a guarantee of confidentiality from the web security model (the host serving the web package has access to plain text). We recognise that the use cases satisfied by web packaging are useful, and would be likely to support an approach that enabled such use cases so long as the foregoing concerns could be addressed." Mozilla has the proposal marked as "harmful". Apple/Webkit have concerns as well: https://news.ycombinator.com/item?id=19679621 https://news.ycombinator.com/item?id=19679621
    - deleted 7y ago
      [deleted]
    - Ajedi32 7y ago
      > We recognise that the use cases satisfied by web packaging are useful, and would be likely to support an approach that enabled such use cases[...] That doesn't sound "highly opposed" to me. Anyway, I read the full report from Mozilla back when they first published it, and while they do have some valid concerns (any new feature introduced to the web will necessarily introduce some new attack surfaces) I believe their concerns are already sufficiently well addressed by the standard. The paragraph from Mozilla that you quoted is also rather vague and misleading. In particular: > the ability for an origin to act on behalf of another without a client ever contacting the authoritative server is worrisome This is super vague. I see no reason why that should be "worrisome". That sort of thing happens all the time in public key cryptography. When you receive a message signed with the private key of a trusted actor, it's perfectly reasonable to trust that the trusted actor authorized that message regardless of where the message itself came from. TLS itself already does exactly that every time you visit a website over HTTPS (your browser trusts certificates signed by a trusted CA, even though those certificates are being presented by an untrusted website, not the CA itself). > as is the removal of a guarantee of confidentiality from the web security model This concern is completely unfounded, and I'm surprised Mozilla included it in their summary. The use of the signed exchange standard doesn't reveal any information to any party that would not already have access to that information without the standard (a host serving you a link to a static, public page will necessarily already have access to the plaintext content of that page, regardless of whether they serve you that content themselves or not).
      - tyingq 7y ago
        >That doesn't sound "highly opposed" to me They marked the proposal as "harmful", and it remains marked that way. I wasn't trying to exaggerate. I could cite other passages that support "highly opposed". Mozilla did publish a pretty extensive document that explains their position and plans: https://docs.google.com/document/d/1ha00dSGKmjoEh2mRiG8FIA5sJ1KihTuZe-AXX1r8P-8/edit?usp=sharing https://docs.google.com/document/d/1ha00dSGKmjoEh2mRiG8FIA5s...
  - JohnFen 7y ago
    > I don't see how you can call that a "lie". It's a lie because the URL being displayed does not reflect the source of the bits. > If I'm offline and I open an offline cached page in my browser, would you call it a lie if the browser displays the URL I originally downloaded that page from That's a bit of a gray area. Yes, it is a lie (the browser should provide an indication of the actual source of the bits). On the other hand, the cache was created by you and exists on your own machine, so it's more of a little white lie in that case.
    - echeese 7y ago
      What about something like Cloudflare, would you say they're lying when they return a cached file instead of contacting the origin server?
      - JohnFen 7y ago
        Yes, because Cloudflare isn't telling me that it's coming from them. However, that's already a lost battle.
danans 7y ago
> oh wow, Signed Exchanges are worse than AMP! > "make sure you are visiting mybanksite.com" is no longer safe. Sounds like you don't trust public key based content signing. This is just broadening public key based signatures beyond the domain to include the domain and the content itself, and using signing to make the authenticity of the content independent of the physical infrastructure that served it. That' what's being used here to verify authenticity of content's source, just like PGP/GPG does for signed emails. That's a far stronger guarantee than "the data is authentic because it came IP address range X purchased by company Y". In fact, without a such signature, there is no guarantee that just because a piece of content came from a particular server/datacenter, that it is authentic. With signed exchanges, the chain of authenticity is pushed all the way back to the website's content creators - it doesn't stop at the web server. Also, this can't be phished unless you break the the content signing algorithms, and if that happens ... we all have bigger problems.
- buboard 7y ago
  first, it breaks the URL specification, as the "host" is no longer a host. it breaks user's expectation of one of the VERY FEW things that everyday users understand about the internet. one may manage to upload an html file to the bank's server and serve a -signed- page that google amp will cache, and then use it to phish customers from within the bank's domain. Or just use a stolen key to make thousands of such pages before the bank finds out. I think , contrary to what you say, it's a brand new, major attack surface.
  - Ajedi32 7y ago
    > one may manage to upload an html file to the bank's server and serve a -signed- page that google amp will cache Only if you have the bank's private key, and the ability to serve arbitrary content from the bank's domain. In which case... yeah, I don't see how the signed exchanges standard makes that problem significantly worse.
    - buboard 7y ago
      i don't know what's the max expiration for amp's cache, but i could set a really-long expiration date on the file and remove it from the server without the bank ever knowing it existed. SGX don't even require an upload - one disgruntled employee could do the same with a stolen key. Nobody benefits from this shit than google. Do we really need more attack surfaces?

oh wow, Signed Exchanges are worse than AMP! "make sure you are visiting mybanksite.com" is no longer safe.

echeese 7y ago

How is it no longer safe?

buboard 7y ago
Phishing
- echeese 7y ago
  They can't alter the content - that's where the 'signed' part comes in. Any forms there would still go to the original source.

JohnFen 7y ago

I don't think there's a real phishing risk with them, but I object to Signed Exchanges because they are actively making the browser lie to me about the URL being used.

Ajedi32 7y ago
The URL the browser shows is the one which was cryptographically verified to be correct. I don't see how you can call that a "lie". If I'm offline and I open an offline cached page in my browser, would you call it a lie if the browser displays the URL I originally downloaded that page from in the URL bar instead of saying it came from "your hard drive"?
- tyingq 7y ago
  It's not just us HN commenters that are concerned. Mozilla, for example, is highly opposed to it in it's current state. "Mozilla has concerns about the shift in the web security model required for handling web-packaged information. Specifically, the ability for an origin to act on behalf of another without a client ever contacting the authoritative server is worrisome, as is the removal of a guarantee of confidentiality from the web security model (the host serving the web package has access to plain text). We recognise that the use cases satisfied by web packaging are useful, and would be likely to support an approach that enabled such use cases so long as the foregoing concerns could be addressed." Mozilla has the proposal marked as "harmful". Apple/Webkit have concerns as well: https://news.ycombinator.com/item?id=19679621 https://news.ycombinator.com/item?id=19679621
  - deleted 7y ago
    [deleted]
  - Ajedi32 7y ago
    > We recognise that the use cases satisfied by web packaging are useful, and would be likely to support an approach that enabled such use cases[...] That doesn't sound "highly opposed" to me. Anyway, I read the full report from Mozilla back when they first published it, and while they do have some valid concerns (any new feature introduced to the web will necessarily introduce some new attack surfaces) I believe their concerns are already sufficiently well addressed by the standard. The paragraph from Mozilla that you quoted is also rather vague and misleading. In particular: > the ability for an origin to act on behalf of another without a client ever contacting the authoritative server is worrisome This is super vague. I see no reason why that should be "worrisome". That sort of thing happens all the time in public key cryptography. When you receive a message signed with the private key of a trusted actor, it's perfectly reasonable to trust that the trusted actor authorized that message regardless of where the message itself came from. TLS itself already does exactly that every time you visit a website over HTTPS (your browser trusts certificates signed by a trusted CA, even though those certificates are being presented by an untrusted website, not the CA itself). > as is the removal of a guarantee of confidentiality from the web security model This concern is completely unfounded, and I'm surprised Mozilla included it in their summary. The use of the signed exchange standard doesn't reveal any information to any party that would not already have access to that information without the standard (a host serving you a link to a static, public page will necessarily already have access to the plaintext content of that page, regardless of whether they serve you that content themselves or not).
    - tyingq 7y ago
      >That doesn't sound "highly opposed" to me They marked the proposal as "harmful", and it remains marked that way. I wasn't trying to exaggerate. I could cite other passages that support "highly opposed". Mozilla did publish a pretty extensive document that explains their position and plans: https://docs.google.com/document/d/1ha00dSGKmjoEh2mRiG8FIA5sJ1KihTuZe-AXX1r8P-8/edit?usp=sharing https://docs.google.com/document/d/1ha00dSGKmjoEh2mRiG8FIA5s...
- JohnFen 7y ago
  > I don't see how you can call that a "lie". It's a lie because the URL being displayed does not reflect the source of the bits. > If I'm offline and I open an offline cached page in my browser, would you call it a lie if the browser displays the URL I originally downloaded that page from That's a bit of a gray area. Yes, it is a lie (the browser should provide an indication of the actual source of the bits). On the other hand, the cache was created by you and exists on your own machine, so it's more of a little white lie in that case.
  - echeese 7y ago
    What about something like Cloudflare, would you say they're lying when they return a cached file instead of contacting the origin server?
    - JohnFen 7y ago
      Yes, because Cloudflare isn't telling me that it's coming from them. However, that's already a lost battle.

danans 7y ago

> oh wow, Signed Exchanges are worse than AMP! > "make sure you are visiting mybanksite.com" is no longer safe. Sounds like you don't trust public key based content signing. This is just broadening public key based signatures beyond the domain to include the domain and the content itself, and using signing to make the authenticity of the content independent of the physical infrastructure that served it. That' what's being used here to verify authenticity of content's source, just like PGP/GPG does for signed emails. That's a far stronger guarantee than "the data is authentic because it came IP address range X purchased by company Y". In fact, without a such signature, there is no guarantee that just because a piece of content came from a particular server/datacenter, that it is authentic. With signed exchanges, the chain of authenticity is pushed all the way back to the website's content creators - it doesn't stop at the web server. Also, this can't be phished unless you break the the content signing algorithms, and if that happens ... we all have bigger problems.

buboard 7y ago
first, it breaks the URL specification, as the "host" is no longer a host. it breaks user's expectation of one of the VERY FEW things that everyday users understand about the internet. one may manage to upload an html file to the bank's server and serve a -signed- page that google amp will cache, and then use it to phish customers from within the bank's domain. Or just use a stolen key to make thousands of such pages before the bank finds out. I think , contrary to what you say, it's a brand new, major attack surface.
- Ajedi32 7y ago
  > one may manage to upload an html file to the bank's server and serve a -signed- page that google amp will cache Only if you have the bank's private key, and the ability to serve arbitrary content from the bank's domain. In which case... yeah, I don't see how the signed exchanges standard makes that problem significantly worse.
  - buboard 7y ago
    i don't know what's the max expiration for amp's cache, but i could set a really-long expiration date on the file and remove it from the server without the bank ever knowing it existed. SGX don't even require an upload - one disgruntled employee could do the same with a stolen key. Nobody benefits from this shit than google. Do we really need more attack surfaces?