3 ms·

What Cloudflare's announced is more than just DOM reconstruction, though. They sound very different to the likes of Opera Mini Turbo or Amazon Silk's Cloud Brow

What Cloudflare's announced is more than just DOM reconstruction, though. They sound very different to the likes of Opera Mini Turbo or Amazon Silk's Cloud Browser or Chrome's Fly Wheel...[0] In Cloudflare's case, the rendering happens on the server and only rasterization commands are sent to the clients similar to AWS NICE [1]. As a security product (if you trust Cloudflare), browser isolation sounds super tempting on-paper. As they mention in the blogspot, an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser. DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2]. So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly. I have also been following MightyApp.com that is trying to do something similar but for consumers and with focus on productivity. It is interesting to see how this would play out. If there's a huge market for this, Google is sure to pounce on it too, and then things will get real interesting... as if AMP, WebComponents [2] and Privacy Sandbox [3] weren't already enough. [0] https://news.ycombinator.com/item?id=19774768 https://news.ycombinator.com/item?id=19774768 [1] https://aws.amazon.com/hpc/dcv/ https://aws.amazon.com/hpc/dcv/ [2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-generation-algorithms.html https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen... [3] https://news.ycombinator.com/item?id=24390324 https://news.ycombinator.com/item?id=24390324 [4] https://news.ycombinator.com/item?id=20767891 https://news.ycombinator.com/item?id=20767891

lucideer 6y ago
> very different to the likes of Opera Mini [...] In Cloudflare's case, the rendering happens on the server and only rasterization commands are sent to the clients. Literally exactly what Opera Mini has done since circa 2005[0]. The main difference here is that Opera Mini progressed to the gp's "2025" scenario quite some time ago by adding limited support for events alongside OBML's rasterization commands. [0] https://github.com/grawity/obml-parser/blob/master/obml.md https://github.com/grawity/obml-parser/blob/master/obml.md
resfirestar 6y ago
> an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser Credential phishing doesn’t care where your browser is running, as I frequently have to remind IT teams who think their web proxy logs can identify 100% of victims of a phishing attack (there are almost always a few people who clicked on their phone). RBI of this type is specifically to mitigate vulnerabilities in the browser engine, the type of 0-day where you just click on the wrong thing and get owned. While these are a real threat, they are nowhere near 70%, more like less than 1% (and see my other comment about how the 70% number is just made up). > [2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen... Domain generation algorithms are used for malware command and control, not in the browser/phishing stage of an attack. An actual reason DNS blacklists aren’t perfect for this purpose is that attackers host malware distribution and phishing pages on legitimate services like Google Docs and Sharepoint.
- ignoramous 6y ago
  I should have been clearer: Domain generation algorithms render solutions like Google SafeBrowsing vulnerable. Sure, these are only used by botnets today, but before we know it, it'd be put to use by adware and spyware too.
  - resfirestar 6y ago
    DGAs aren't a solution to the "my phishing page is blocked by safebrowsing/some other blacklist" problem. You can't send someone an email with a "link" that generates URLs until one of them isn't blocked: hyperlinks aren't programmable in that sense. You can send them a link to a page that does that, sure, but that doesn't stop them from blacklisting the redirector page. How would someone running a phishing campaign actually use a DGA?
Wowfunhappy 6y ago
> So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly. Oh, to be clear, my post wasn't intended as a criticism of Cloudflare! Yes, Browser Isolation looks like it could be a great product. If I sounded frustrated—which also wasn't intended—my frustration was with the industry more generally, for moving between technologies too quickly without learning from the past.
kccqzy 6y ago
> DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2]. Can you explain why not? Your reference is talking about malware C&C trying to confuse reverse engineers, not phishing attacks happening in a browser.

lucideer 6y ago

> very different to the likes of Opera Mini [...] In Cloudflare's case, the rendering happens on the server and only rasterization commands are sent to the clients. Literally exactly what Opera Mini has done since circa 2005[0]. The main difference here is that Opera Mini progressed to the gp's "2025" scenario quite some time ago by adding limited support for events alongside OBML's rasterization commands. [0] https://github.com/grawity/obml-parser/blob/master/obml.md https://github.com/grawity/obml-parser/blob/master/obml.md

resfirestar 6y ago

> an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser Credential phishing doesn’t care where your browser is running, as I frequently have to remind IT teams who think their web proxy logs can identify 100% of victims of a phishing attack (there are almost always a few people who clicked on their phone). RBI of this type is specifically to mitigate vulnerabilities in the browser engine, the type of 0-day where you just click on the wrong thing and get owned. While these are a real threat, they are nowhere near 70%, more like less than 1% (and see my other comment about how the 70% number is just made up). > [2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen... Domain generation algorithms are used for malware command and control, not in the browser/phishing stage of an attack. An actual reason DNS blacklists aren’t perfect for this purpose is that attackers host malware distribution and phishing pages on legitimate services like Google Docs and Sharepoint.

ignoramous 6y ago
I should have been clearer: Domain generation algorithms render solutions like Google SafeBrowsing vulnerable. Sure, these are only used by botnets today, but before we know it, it'd be put to use by adware and spyware too.
- resfirestar 6y ago
  DGAs aren't a solution to the "my phishing page is blocked by safebrowsing/some other blacklist" problem. You can't send someone an email with a "link" that generates URLs until one of them isn't blocked: hyperlinks aren't programmable in that sense. You can send them a link to a page that does that, sure, but that doesn't stop them from blacklisting the redirector page. How would someone running a phishing campaign actually use a DGA?

Wowfunhappy 6y ago

> So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly. Oh, to be clear, my post wasn't intended as a criticism of Cloudflare! Yes, Browser Isolation looks like it could be a great product. If I sounded frustrated—which also wasn't intended—my frustration was with the industry more generally, for moving between technologies too quickly without learning from the past.

kccqzy 6y ago

> DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2]. Can you explain why not? Your reference is talking about malware C&C trying to confuse reverse engineers, not phishing attacks happening in a browser.