6 ms·

Another way of looking at this scoreboard is as an approximate inverse ranking of webmail client security and leak vectors, with Gmail stripping far more danger

Another way of looking at this scoreboard is as an approximate inverse ranking of webmail client security and leak vectors, with Gmail stripping far more dangerous elements than most webmail clients. This is actually a great tool to find vulnerabilities in various webmail clients such as ProtonMail and Hey, just compare the HTML or CSS features they do not yet filter compared to Gmail, then do a search for "[feature] + exploit" to see how a feature could be abused, and then submit a bounty report. For example, there are alot of good reasons that you may not want your webmail rendering SVG images (mXSS, appcache poisoning) or allowing CSS variables or imports. And I'm pretty sure the list supported by Gmail could also be narrowed down further. There are some fantastic bounties lurking in here, just waiting to be discovered.

felixfbecker 5y ago
Curious, what's the risk with SVG, assuming a CSP is used for it that doesn't allow anything (including no scripts)?
- jorangreef 5y ago
  SVG is a minefield so massive it's hard to give an exhaustive list of everything that could go wrong. Especially when these kinds of assets might be hosted on user content domains and where webmail clients might allow access to the SVG content with inline disposition but outside of an IMG tag (most browsers enable/disable various SVG features such as JS or an app cache manifest according to context). There are also a ton of weird rendering modes that can be triggered for SVG (or MathML) and these can be used to bypass XSS sanitizers by means of mXSS which exploits differences in browser renderings when roundtripping content. And sites with strong CSPs are often especially vulnerable to scriptless attacks, perhaps because they feel more protected. For example, in 2019, there was a bug bounty disclosure to Fastmail about a way to intercept and proxy all email attachment downloads, completely client-side, and yet without involving any JavaScript, simply using HTML5 AppCache. This also affected a whole lot of other providers, but the Fastmail team patched this within 24 hours, a pretty amazing response, and the quickest by far. Here's a fantastic paper from Mario Heiderich (of Cure53) from 2012 on various kinds of scriptless attacks: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.469.7647&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.46...
  - Pxtl 5y ago
    I've said it before, I'll say it again: the web needed a vector answer to jpeg, but what we got was a vector answer to html+css with all their commensurate vulnerabilities and complexities.
    - whatshisface 5y ago
      The other major web vector format... is PDF. Yeah, PDF has drawing commands. Most vector formats are based on command sequences, that map 1-1 with what you'd find in a drawing library like Cairo. EPS and PDF both work that way, which makes it even more of a typical vector format than SVG (which only does the command sequence thing with paths, AFAIK). Of course, it's not that well supported (the in-browser reader does who-knows-what to get it to render, I think it's converted to DOM elements), but it is the other major browser-supported vector format.
jb1991 5y ago
I’d love to know where FastMail ranks on here.
- jorangreef 5y ago
  Fastmail's security is top notch. They're using Cure53's DOMPurify and their team understand these vectors really well, with strict filtering. Their pixel tracking blocking was better than Hey's when last I checked, and I reported three leaks to Hey that were not fixed for some time. Fastmail also run one of the best bounties I have ever participated in. I would even say significantly better than ProtonMail, having participated in both bug bounties.
  - darkwater 5y ago
    Nice to hear that, I'm a Fastmail customer and the Android up is subpar on offline access (or unreliable connections, looks like it's basically hitting the network for everything. Knowing that at least security-wise it's a good product makes me happier.
    - noneeeed 5y ago
      What are the advantages of using FastMail's android app over a normal mail client? I'm thinking of moving to Fastmail from Gmail.
      - stevehawk 5y ago
        shrug dunno what other mail clients have but I've used Fastmail's email client for over a decade and never thought "wonder if someone else's is better".
      - darkwater 5y ago
        Some more integration with other FastMail services (like calendar or "disk space" for files) mainly. Also normal MUAs on Android are usually ugly as hell, I still have to find one that I really like. But the online-only bug of FM client is really becoming an issue worth switching.
defaultname 5y ago
So discover them. Roll in your piles of cash from those easy picking bounties. Prove your point because otherwise it seems like a rather lazy claim. Somehow I think it is significantly harder to actually do. The position itself seems like sophistry: Was Internet Explorer the most secure browser when it was obsolete dogshit that supported little? These "more/newer is scary and dangerous" positions appear on literally everything, always, and they're always based on a wink and innuendo. But I would posit that gmail supports little because it's overwhelmingly dominant and they simply don't have to. Gmail has little market pressure to do much of anything.
- jorangreef 5y ago
  > So discover them. Roll in your piles of cash from those easy picking bounties. Prove your point. Sure, I already did. I earned the second highest bounty for Fastmail back in 2019 for exactly this kind of exploit. Since then I've reported to dozens of programs (OpenSSL, ClamAV, SpamAssassin, ProtonMail, Hey, Missive, Yahoo Mail, Yandex, Spark, Trello, Missive, AWS, Google Chrome) and rolled in a few tidy piles. I have also written various pieces of open-source software that would have detected and prevented four separate zero-days, affecting Microsoft (and almost every AV engine, browser, and zip parser) [1][2], Gmail [3], Apple Mail [4], and countless open-source email servers [5]. Now it's your turn. [1] https://github.com/ronomon/pure https://github.com/ronomon/pure [2] https://www.usenix.org/conference/woot19/presentation/fifield https://www.usenix.org/conference/woot19/presentation/fifiel... [3] https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hid... [4] https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c https://mikko-kenttala.medium.com/zero-click-vulnerability-i... [5] https://snyk.io/blog/how-to-crash-an-email-server-with-a-single-email/ https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin...
  - defaultname 5y ago
    I'm not quite sure what flaws in attachment handling/zip bombs [literally one of the oldest and most rudimentary features] and another to do with UI encoding has to do with this post. Neither have anything to do with advanced HTML support. Software has bugs, story at 11. Should they have banned attachments as too scary and new? That is a completely orthogonal bit to claim authority and "win". And it will probably work on many (citations, even if wholly irrelevant -- as these are -- are a magic pixie dust on HN [1]). Weird. 100% of the time that someone claims something is easy money, their claim is, shall we say, "dubious". It's noisy bluster. Your Fastmail bounty [2] is impressive and kudos, but again it looks like it has to do with Fastmail's implementation details to support offline use. [1] https://news.ycombinator.com/item?id=26264378 https://news.ycombinator.com/item?id=26264378 [2] https://news.ycombinator.com/item?id=13099966 https://news.ycombinator.com/item?id=13099966
stephenr 5y ago
Oh yeah. Those nth-child* selectors Gmail strips out are a real security nightmare.

felixfbecker 5y ago

Curious, what's the risk with SVG, assuming a CSP is used for it that doesn't allow anything (including no scripts)?

jorangreef 5y ago
SVG is a minefield so massive it's hard to give an exhaustive list of everything that could go wrong. Especially when these kinds of assets might be hosted on user content domains and where webmail clients might allow access to the SVG content with inline disposition but outside of an IMG tag (most browsers enable/disable various SVG features such as JS or an app cache manifest according to context). There are also a ton of weird rendering modes that can be triggered for SVG (or MathML) and these can be used to bypass XSS sanitizers by means of mXSS which exploits differences in browser renderings when roundtripping content. And sites with strong CSPs are often especially vulnerable to scriptless attacks, perhaps because they feel more protected. For example, in 2019, there was a bug bounty disclosure to Fastmail about a way to intercept and proxy all email attachment downloads, completely client-side, and yet without involving any JavaScript, simply using HTML5 AppCache. This also affected a whole lot of other providers, but the Fastmail team patched this within 24 hours, a pretty amazing response, and the quickest by far. Here's a fantastic paper from Mario Heiderich (of Cure53) from 2012 on various kinds of scriptless attacks: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.469.7647&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.46...
- Pxtl 5y ago
  I've said it before, I'll say it again: the web needed a vector answer to jpeg, but what we got was a vector answer to html+css with all their commensurate vulnerabilities and complexities.
  - whatshisface 5y ago
    The other major web vector format... is PDF. Yeah, PDF has drawing commands. Most vector formats are based on command sequences, that map 1-1 with what you'd find in a drawing library like Cairo. EPS and PDF both work that way, which makes it even more of a typical vector format than SVG (which only does the command sequence thing with paths, AFAIK). Of course, it's not that well supported (the in-browser reader does who-knows-what to get it to render, I think it's converted to DOM elements), but it is the other major browser-supported vector format.

jb1991 5y ago

I’d love to know where FastMail ranks on here.

jorangreef 5y ago
Fastmail's security is top notch. They're using Cure53's DOMPurify and their team understand these vectors really well, with strict filtering. Their pixel tracking blocking was better than Hey's when last I checked, and I reported three leaks to Hey that were not fixed for some time. Fastmail also run one of the best bounties I have ever participated in. I would even say significantly better than ProtonMail, having participated in both bug bounties.
- darkwater 5y ago
  Nice to hear that, I'm a Fastmail customer and the Android up is subpar on offline access (or unreliable connections, looks like it's basically hitting the network for everything. Knowing that at least security-wise it's a good product makes me happier.
  - noneeeed 5y ago
    What are the advantages of using FastMail's android app over a normal mail client? I'm thinking of moving to Fastmail from Gmail.
    - stevehawk 5y ago
      shrug dunno what other mail clients have but I've used Fastmail's email client for over a decade and never thought "wonder if someone else's is better".
    - darkwater 5y ago
      Some more integration with other FastMail services (like calendar or "disk space" for files) mainly. Also normal MUAs on Android are usually ugly as hell, I still have to find one that I really like. But the online-only bug of FM client is really becoming an issue worth switching.

defaultname 5y ago

So discover them. Roll in your piles of cash from those easy picking bounties. Prove your point because otherwise it seems like a rather lazy claim. Somehow I think it is significantly harder to actually do. The position itself seems like sophistry: Was Internet Explorer the most secure browser when it was obsolete dogshit that supported little? These "more/newer is scary and dangerous" positions appear on literally everything, always, and they're always based on a wink and innuendo. But I would posit that gmail supports little because it's overwhelmingly dominant and they simply don't have to. Gmail has little market pressure to do much of anything.

jorangreef 5y ago
> So discover them. Roll in your piles of cash from those easy picking bounties. Prove your point. Sure, I already did. I earned the second highest bounty for Fastmail back in 2019 for exactly this kind of exploit. Since then I've reported to dozens of programs (OpenSSL, ClamAV, SpamAssassin, ProtonMail, Hey, Missive, Yahoo Mail, Yandex, Spark, Trello, Missive, AWS, Google Chrome) and rolled in a few tidy piles. I have also written various pieces of open-source software that would have detected and prevented four separate zero-days, affecting Microsoft (and almost every AV engine, browser, and zip parser) [1][2], Gmail [3], Apple Mail [4], and countless open-source email servers [5]. Now it's your turn. [1] https://github.com/ronomon/pure https://github.com/ronomon/pure [2] https://www.usenix.org/conference/woot19/presentation/fifield https://www.usenix.org/conference/woot19/presentation/fifiel... [3] https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hid... [4] https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c https://mikko-kenttala.medium.com/zero-click-vulnerability-i... [5] https://snyk.io/blog/how-to-crash-an-email-server-with-a-single-email/ https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin...
- defaultname 5y ago
  I'm not quite sure what flaws in attachment handling/zip bombs [literally one of the oldest and most rudimentary features] and another to do with UI encoding has to do with this post. Neither have anything to do with advanced HTML support. Software has bugs, story at 11. Should they have banned attachments as too scary and new? That is a completely orthogonal bit to claim authority and "win". And it will probably work on many (citations, even if wholly irrelevant -- as these are -- are a magic pixie dust on HN [1]). Weird. 100% of the time that someone claims something is easy money, their claim is, shall we say, "dubious". It's noisy bluster. Your Fastmail bounty [2] is impressive and kudos, but again it looks like it has to do with Fastmail's implementation details to support offline use. [1] https://news.ycombinator.com/item?id=26264378 https://news.ycombinator.com/item?id=26264378 [2] https://news.ycombinator.com/item?id=13099966 https://news.ycombinator.com/item?id=13099966

stephenr 5y ago

Oh yeah. Those nth-child* selectors Gmail strips out are a real security nightmare.