5 ms·

This is really bad. First: UA is unreliable, and is a complete mess. Second: it can kill competition. Third: it should be possible for anyone to write a browser

by pmlnr 7y ago

This is really bad. First: UA is unreliable, and is a complete mess. Second: it can kill competition. Third: it should be possible for anyone to write a browser. We need more of them, not less. The web is one step away from needing to buy secure boot UEFI key like permissions for accessing it. EDIT oh. This could also explain my constant token refresh issues with Evolution to access google calendars.

smitty1e 7y ago
> We need more of them, not less. While not sacrificing security, of course.
- sverige 7y ago
  Whose security? If Google can track everything I do online, that's not 'secure' in my book, so Chrome is out.
  - throwawaymath 7y ago
    Security is distinct from privacy. The four mainstream browsers - Chrome, Firefox, Edge and Safari - have the most secure software, regardless of their producers' business models and data hygiene.
    - falcolas 7y ago
      > The four mainstream browsers - Chrome, Firefox, Edge and Safari - have the most secure software I disagree that they are "the most secure" browsers, let alone software. They fail to isolate remote scripts properly; that people were capable of executing timing attacks against the CPU (Specter et.al.) shows that they are not really very secure. Browsers which don't execute Javascript and advanced CSS (Lynx being one extreme example) are going to be much more secure by default.
      - deleted 7y ago
        [deleted]
      - jcranmer 7y ago
        There are four major dimensions to security: attack surface; depth of defense, or how much an attacker can do once they're in; proactive measures to find security bugs (e.g., fuzzing); and code quality. You're focusing on attack surface. But from a security standpoint, attack surface is probably the least important factor. Every sufficiently large application has a hole in it, and all attack surface does is crudely control how likely it is to stumble across that hole. Defense in depth, by contrast, lets you keep the attacker from doing bad things such as installing ransomware on your computer just because your HTML parser had a buffer overflow. The major browsers spend a lot of time sandboxing their scripts in separate processes, and then disabling capabilities of those processes using techniques such as pledge(1), giving them much better defense in depth. They also put a lot more effort into finding and closing security bugs through use of techniques such as fuzzing. No one questions their much larger attack surface, but they do have much more effort into ameliorating attack vulnerabilities. I should also bring up Spectre because you did. At its core, Spectre allows you to read arbitrary memory in your current memory space, nothing more. As a result, it basically means that you can't build an effective in-process sandbox... which everyone already knew to begin with. What Spectre did was show how easy it was do such arbitrary memory reads, since you can proxy it through code as innocent as an array bounds check. There are mitigations for this, which requires rebuilding your entire application and all libraries with special mitigation flags... guess which browser is more likely to do that?
        tptacek 7y ago
        This is kind of a strange analysis. Sort of infamously, Dan Bernstein, who is sort of a pioneer in these privilege-separated defensive designs, foreswore them in a retrospective paper about qmail. Really, though, I'm not sure I'm clear on the distinction you're drawing between attack surface reduction and privilege separation, since both techniques are essentially about reducing the impact of bugs without eliminating the bugs themselves. You might more coherently reduce security to "mitigation" and "prevention", but then that doesn't make much of an argument about the topic at hand.
    - zAy0LfpBZLC8mAC 7y ago
      > Security is distinct from privacy. No, it's not. Security is not a goal in itself, it can not be, security is only about guaranteeing other goals, there is no security absent all other goals. What it means for software to be insecure is that it doesn't ensure your goals are met. For many, privacy is an important goal. If the software that you are using compromises your privacy that you value, then that software is not secure.
      - joshuamorton 7y ago
        I am much more concerned about someone being able to impersonate me (security) than to know what I'm doing (privacy). This doesn't mean im unconcerned about the latter. If secure software compromises privacy in ways that concern you, it may not be the right software for you to use, but it is still secure (and potentially more secure than other software that you feel better protects your privacy).
        zAy0LfpBZLC8mAC 7y ago
        > I am much more concerned about someone being able to impersonate me Well, great?! > (security) Erm ... no? > than to know what I'm doing (privacy) Privacy is not about what your software knows, it's about who else gets access to that information. Software allowing access to your information to parties other than the ones that you intended is a vulnerability class commonly called "information leak". > This doesn't mean im unconcerned about the latter. And thus it is, as per the common understanding of the word, a security concern. > If secure software compromises privacy in ways that concern you That's just logical nonsense. You might as well be saying "If secure software kills you in ways that concern you, [...]". > it may not be the right software for you to use, but it is still secure So, let's assume your browser had a bug where for some reason, every website could read all the data in the browser. Like, could access the storage, cookies, cache, history, page contents, everything. But no write access. This is obviously purely a privacy violation ... but, according to your definition, not a security problem, right?
        joshuamorton 7y ago
- the8472 7y ago
  Software security is not a super-goal. Acceptable risk levels vary with circumstances. If you browse wikipedia on a kiosk-style machine it doesn't really matter whether it's mining bitcoin or not. Or if you're visiting north korea then perhaps using your host's prescribed software stack may be preferable over bringing your own. Even logging into an account from an insecure machine can be acceptable if you're using a low-value account. Some people do use throwaways regularly.
  - shadowgovt 7y ago
    Google's assumption for its user's accounts though is that they're used as "keys to the kingdom." They're not optimizing for the throwaway account experience regarding security.
- danShumway 7y ago
  What security? The very narrow instance where your browser allows a MITM attack, and for some bizarre reason the attacker can't change the user agent to match Chrome's? I am of the feeling that if Google's security practices require trusting an attacker not to change a user agent -- well frankly, in that case I am skeptical these changes are actually about security. Because the Google security team is smart, and I assume they wouldn't do stupid things. But I am cautious about jumping to "this is malicious." There is certainly enough anecdotal evidence for a reasonable person to claim that Google targets competitors and tries to use changes like this to hurt them. However, it's not (currently) enough evidence for me. I am still naive enough to believe there is some semblance of good will at the company. But I feel very comfortable saying that this is security change won't do much good, and the Google security team probably just thought, "why not turn it on?" without caring about potential consequences to competitors, because they don't think about anything outside of Google's ecosystem. I generally don't get the feeling that Google engineers are malicious, just that they're thoughtless and/or careless. I don't get the feeling that they're trying to mess up the web ecosystem, just that they act impulsively and feel very strongly that people shouldn't be questioning them; and that when people do question them, they tend to dig in their heels and become very condescending very quickly. But again, I know there are Edge devs and Vivaldi devs that would call me naive.
  - shadowgovt 7y ago
    If the browsers in question don't correctly implement all necessary standards to guard against XSS, frame-busting, and MITM attacks, Google will do what it can to protect its users against foot-shooting. Changing the UA is equivalent to "voiding the warranty," so I'm not surprised Google isn't taking extraordinary measures. At some point, if your users really want to shoot their feet, there's only but so much you can do to stop them.
    - danShumway 7y ago
      If a browser doesn't implement the standards to guard against MITM attacks, what makes you think it implements the standards to guard against user-agent manipulation during the MITM attack? You've misunderstood what I'm getting at here. It's not the user that's going to purposefully change their agent -- it's that a browser that is insecure to the point that you can't trust it to log in is also insecure to the point that you can't trust its user agent to be reported correctly. The entire security exercise is pointless because compromised browsers lie. They don't respect user preferences. An attacker who intercepts and modifies a request isn't going to suddenly start being honest with you when you ask what browser that request came from.
- userbinator 7y ago
  I felt compelled to once again post the classic quote that's taken on a whole new meaning in this coming digital dystopia: "Those who give up freedom for security deserve neither." The vision of "security" that these large companies have is to secure complete control over every aspect of your life, and the sooner the population realises that and stops believing their propaganda, the better. Google's continued destruction of the Internet through things like obfuscating URLs, purposefully degrading search results, and invasive RECAPTCHA-based surveillance is absolutely disgusting.

by pmlnr 7y ago

smitty1e 7y ago

> We need more of them, not less. While not sacrificing security, of course.

sverige 7y ago
Whose security? If Google can track everything I do online, that's not 'secure' in my book, so Chrome is out.
- throwawaymath 7y ago
  Security is distinct from privacy. The four mainstream browsers - Chrome, Firefox, Edge and Safari - have the most secure software, regardless of their producers' business models and data hygiene.
  - falcolas 7y ago
    > The four mainstream browsers - Chrome, Firefox, Edge and Safari - have the most secure software I disagree that they are "the most secure" browsers, let alone software. They fail to isolate remote scripts properly; that people were capable of executing timing attacks against the CPU (Specter et.al.) shows that they are not really very secure. Browsers which don't execute Javascript and advanced CSS (Lynx being one extreme example) are going to be much more secure by default.
    - deleted 7y ago
      [deleted]
    - jcranmer 7y ago
      There are four major dimensions to security: attack surface; depth of defense, or how much an attacker can do once they're in; proactive measures to find security bugs (e.g., fuzzing); and code quality. You're focusing on attack surface. But from a security standpoint, attack surface is probably the least important factor. Every sufficiently large application has a hole in it, and all attack surface does is crudely control how likely it is to stumble across that hole. Defense in depth, by contrast, lets you keep the attacker from doing bad things such as installing ransomware on your computer just because your HTML parser had a buffer overflow. The major browsers spend a lot of time sandboxing their scripts in separate processes, and then disabling capabilities of those processes using techniques such as pledge(1), giving them much better defense in depth. They also put a lot more effort into finding and closing security bugs through use of techniques such as fuzzing. No one questions their much larger attack surface, but they do have much more effort into ameliorating attack vulnerabilities. I should also bring up Spectre because you did. At its core, Spectre allows you to read arbitrary memory in your current memory space, nothing more. As a result, it basically means that you can't build an effective in-process sandbox... which everyone already knew to begin with. What Spectre did was show how easy it was do such arbitrary memory reads, since you can proxy it through code as innocent as an array bounds check. There are mitigations for this, which requires rebuilding your entire application and all libraries with special mitigation flags... guess which browser is more likely to do that?
      - tptacek 7y ago
        This is kind of a strange analysis. Sort of infamously, Dan Bernstein, who is sort of a pioneer in these privilege-separated defensive designs, foreswore them in a retrospective paper about qmail. Really, though, I'm not sure I'm clear on the distinction you're drawing between attack surface reduction and privilege separation, since both techniques are essentially about reducing the impact of bugs without eliminating the bugs themselves. You might more coherently reduce security to "mitigation" and "prevention", but then that doesn't make much of an argument about the topic at hand.
  - zAy0LfpBZLC8mAC 7y ago
    > Security is distinct from privacy. No, it's not. Security is not a goal in itself, it can not be, security is only about guaranteeing other goals, there is no security absent all other goals. What it means for software to be insecure is that it doesn't ensure your goals are met. For many, privacy is an important goal. If the software that you are using compromises your privacy that you value, then that software is not secure.
    - joshuamorton 7y ago
      I am much more concerned about someone being able to impersonate me (security) than to know what I'm doing (privacy). This doesn't mean im unconcerned about the latter. If secure software compromises privacy in ways that concern you, it may not be the right software for you to use, but it is still secure (and potentially more secure than other software that you feel better protects your privacy).
      - zAy0LfpBZLC8mAC 7y ago
        > I am much more concerned about someone being able to impersonate me Well, great?! > (security) Erm ... no? > than to know what I'm doing (privacy) Privacy is not about what your software knows, it's about who else gets access to that information. Software allowing access to your information to parties other than the ones that you intended is a vulnerability class commonly called "information leak". > This doesn't mean im unconcerned about the latter. And thus it is, as per the common understanding of the word, a security concern. > If secure software compromises privacy in ways that concern you That's just logical nonsense. You might as well be saying "If secure software kills you in ways that concern you, [...]". > it may not be the right software for you to use, but it is still secure So, let's assume your browser had a bug where for some reason, every website could read all the data in the browser. Like, could access the storage, cookies, cache, history, page contents, everything. But no write access. This is obviously purely a privacy violation ... but, according to your definition, not a security problem, right?
        joshuamorton 7y ago
the8472 7y ago
Software security is not a super-goal. Acceptable risk levels vary with circumstances. If you browse wikipedia on a kiosk-style machine it doesn't really matter whether it's mining bitcoin or not. Or if you're visiting north korea then perhaps using your host's prescribed software stack may be preferable over bringing your own. Even logging into an account from an insecure machine can be acceptable if you're using a low-value account. Some people do use throwaways regularly.
- shadowgovt 7y ago
  Google's assumption for its user's accounts though is that they're used as "keys to the kingdom." They're not optimizing for the throwaway account experience regarding security.
danShumway 7y ago
What security? The very narrow instance where your browser allows a MITM attack, and for some bizarre reason the attacker can't change the user agent to match Chrome's? I am of the feeling that if Google's security practices require trusting an attacker not to change a user agent -- well frankly, in that case I am skeptical these changes are actually about security. Because the Google security team is smart, and I assume they wouldn't do stupid things. But I am cautious about jumping to "this is malicious." There is certainly enough anecdotal evidence for a reasonable person to claim that Google targets competitors and tries to use changes like this to hurt them. However, it's not (currently) enough evidence for me. I am still naive enough to believe there is some semblance of good will at the company. But I feel very comfortable saying that this is security change won't do much good, and the Google security team probably just thought, "why not turn it on?" without caring about potential consequences to competitors, because they don't think about anything outside of Google's ecosystem. I generally don't get the feeling that Google engineers are malicious, just that they're thoughtless and/or careless. I don't get the feeling that they're trying to mess up the web ecosystem, just that they act impulsively and feel very strongly that people shouldn't be questioning them; and that when people do question them, they tend to dig in their heels and become very condescending very quickly. But again, I know there are Edge devs and Vivaldi devs that would call me naive.
- shadowgovt 7y ago
  If the browsers in question don't correctly implement all necessary standards to guard against XSS, frame-busting, and MITM attacks, Google will do what it can to protect its users against foot-shooting. Changing the UA is equivalent to "voiding the warranty," so I'm not surprised Google isn't taking extraordinary measures. At some point, if your users really want to shoot their feet, there's only but so much you can do to stop them.
  - danShumway 7y ago
    If a browser doesn't implement the standards to guard against MITM attacks, what makes you think it implements the standards to guard against user-agent manipulation during the MITM attack? You've misunderstood what I'm getting at here. It's not the user that's going to purposefully change their agent -- it's that a browser that is insecure to the point that you can't trust it to log in is also insecure to the point that you can't trust its user agent to be reported correctly. The entire security exercise is pointless because compromised browsers lie. They don't respect user preferences. An attacker who intercepts and modifies a request isn't going to suddenly start being honest with you when you ask what browser that request came from.
userbinator 7y ago
I felt compelled to once again post the classic quote that's taken on a whole new meaning in this coming digital dystopia: "Those who give up freedom for security deserve neither." The vision of "security" that these large companies have is to secure complete control over every aspect of your life, and the sooner the population realises that and stops believing their propaganda, the better. Google's continued destruction of the Internet through things like obfuscating URLs, purposefully degrading search results, and invasive RECAPTCHA-based surveillance is absolutely disgusting.