4 ms·

As if we needed yet another reason to avoid Chrome and friends…

RcouF1uZ4gsC 5y ago
I believe Chrome goes much further than Firefox in trying to isolate websites into separate processes. If anything, I would guess that Firefox would be much more vulnerable to these kinds of attacks.
- jack_pp 5y ago
  It might be the case that Firefox is less vulnerable in general because it is not as targeted even though technically it might have more undiscovered exploits.
  - bee_rider 5y ago
    That's just security by obscurity.
    - eropple 5y ago
      "Security by obscurity" is a phrase frequently repeated but generally misunderstood. There is value in not having the lock everybody's trying to pick with very advanced attacks so long as it is generally proof against being kicked down by simpler ones. So, sure, it may be security-by-obscurity--but it can also be significant and helpful depending on one's threat model. "Security by obscurity" is not a disqualifying objection under most models.
    - unethical_ban 5y ago
      Not only is that not always a bad thing, but your statement implies that (a) it is the fault of FF that it is "obscure" for the purposes of security, and (b) that they aren't secure in the traditional sense, and only rely on the obscurity portion.
      - bee_rider 5y ago
        I think the comment I responded implies that, more than mine. I'm writing this in Firefox, and I suspect that it is probably actually more secure in some nebulous sense just because they don't have any need to comply with shady characters like Google. But the particular advantage highlighted doesn't seem so great.
    - dotancohen 5y ago
      Security by obscurity keeps my SSH logs clean. Not many bots come knocking on port 22122 (not the real port).
- latchkey 5y ago
  From the FAQ on the page: We have tested Spook.js on Chromium, which is the basis of the Chrome browser. Thus, in addition to Chrome itself, we expect most Chromium-based browsers to be vulnerable to some variant of Spook.js. This includes recent versions of Microsoft's Edge browser, as well as Brave which is a privacy-centered browser. Other browsers like Firefox and Safari use very different JavaScript execution engines, which currently stops Spook.js from working. We leave the task of investigating speculative exection attacks on these browsers to future work. Finally, Firefox has recently introduced Strict Site Isolation in its stable release. While Spook.js does not work on Firefox as is, we note that similarly to Chrome, Firefox also consolidates pages based on their eTLD+1 domain.

I believe Chrome goes much further than Firefox in trying to isolate websites into separate processes. If anything, I would guess that Firefox would be much more vulnerable to these kinds of attacks.

jack_pp 5y ago
It might be the case that Firefox is less vulnerable in general because it is not as targeted even though technically it might have more undiscovered exploits.
- bee_rider 5y ago
  That's just security by obscurity.
  - eropple 5y ago
    "Security by obscurity" is a phrase frequently repeated but generally misunderstood. There is value in not having the lock everybody's trying to pick with very advanced attacks so long as it is generally proof against being kicked down by simpler ones. So, sure, it may be security-by-obscurity--but it can also be significant and helpful depending on one's threat model. "Security by obscurity" is not a disqualifying objection under most models.
  - unethical_ban 5y ago
    Not only is that not always a bad thing, but your statement implies that (a) it is the fault of FF that it is "obscure" for the purposes of security, and (b) that they aren't secure in the traditional sense, and only rely on the obscurity portion.
    - bee_rider 5y ago
      I think the comment I responded implies that, more than mine. I'm writing this in Firefox, and I suspect that it is probably actually more secure in some nebulous sense just because they don't have any need to comply with shady characters like Google. But the particular advantage highlighted doesn't seem so great.
  - dotancohen 5y ago
    Security by obscurity keeps my SSH logs clean. Not many bots come knocking on port 22122 (not the real port).
latchkey 5y ago
From the FAQ on the page: We have tested Spook.js on Chromium, which is the basis of the Chrome browser. Thus, in addition to Chrome itself, we expect most Chromium-based browsers to be vulnerable to some variant of Spook.js. This includes recent versions of Microsoft's Edge browser, as well as Brave which is a privacy-centered browser. Other browsers like Firefox and Safari use very different JavaScript execution engines, which currently stops Spook.js from working. We leave the task of investigating speculative exection attacks on these browsers to future work. Finally, Firefox has recently introduced Strict Site Isolation in its stable release. While Spook.js does not work on Firefox as is, we note that similarly to Chrome, Firefox also consolidates pages based on their eTLD+1 domain.