4 ms·

Same-origin violation vulnerability in Safari 15 could leak a user’s website

47 points by feross 5y ago

smegsicle 5y ago
"...leak a user’s website history and identity" tl;dr: "Safari 15 on macOS, and in all browsers on iOS and iPadOS 15, the IndexedDB API is violating same-origin policy in the WebKit implementation"
- tailspin2019 5y ago
  Yeah title could do with an update. Truncating it at the other end makes it less misleading/confusing: "Vulnerability in Safari 15 could leak a user’s website history and identity"
crtasm 5y ago
2 days ago: https://news.ycombinator.com/item?id=29947396 https://news.ycombinator.com/item?id=29947396
tptacek 5y ago
This is just leaking the names of indexdb databases, right? Like, it's a particularly useful fingerprinting technique. It's not dumping your history or anything?
- olliej 5y ago
  Correct. It’s clearly a not great bug, but historically (by design) you could get more information via CSS. The only increase is trackability is extracting the google id because I guess google includes that in the db name??
  - wutwutwutwut 5y ago
    Why would you have to guess when the source describe it. Anyway, funny how you mention "only"- the "only" increase in trackability is to be able to retrieve user information about users using the world's most popular online services. I don't want pornhub to be able to view my photo from Google. Comparing this to CSS fingerprinting seems misinformed at best.
    - sa1 5y ago
      I might be misunderstanding you, but it's a leak of database name, not database contents. You can tell someone visited a website by looking at the name, but your photo from Google is safe.
      - wutwutwutwut 5y ago
        I'm so confused now. Did you read about the issue? I wonder if I misunderstood maybe. As I understand it: According to the source, Google inserts unique user ID is into database name. An attacker can make a request to Google, pass in this unique user ID into their API and get profile details, for example a photo back. The attacker does not need access to the database data, only the database name, since the user ID is embedded in the _name_. You are right it's a leak of a database name, but Google store sensitive data in the database name.
        sa1 5y ago
        My reading was that a user can be identified by the userid. I'm not sure what other actions just having an userid authorizes, but I would lay that bit on google.
        wutwutwutwut 5y ago
        Safari leaks very sensitive information (database names) and its on Google? That's bizarre.
        sa1 5y ago
        There are clearly two issues here, only the first one of which has been demonstrated. One is the leak of database names, which is on Apple. The other one is releasing sensitive data on insufficient authorisation(just an user id), which would be on google.
      - tinus_hn 5y ago
        Google allows attackers to retrieve the profile picture of accounts if they know the account name, which they can retrieve using this bug.
danhab99 5y ago
Safari is switching to chromium just like edge. We all know it, let's just cope with it and move on.
- deleted 5y ago
  [deleted]
- tata71 5y ago
  They are? Evidence?
- mrtesthah 5y ago
  Did you hear? MAC’s operating system is really just Windows. MAC never even had their own OS they just stole it from Bill Gates in 1995. I hear Microsoft is going to buy MAC soon because the new IMAXES are slower than Pentium. LOL PC PWNS MAC STEVE JOBS IS LOSER.

47 points by feross 5y ago

"...leak a user’s website history and identity" tl;dr: "Safari 15 on macOS, and in all browsers on iOS and iPadOS 15, the IndexedDB API is violating same-origin policy in the WebKit implementation"

tailspin2019 5y ago
Yeah title could do with an update. Truncating it at the other end makes it less misleading/confusing: "Vulnerability in Safari 15 could leak a user’s website history and identity"

crtasm 5y ago

2 days ago: https://news.ycombinator.com/item?id=29947396 https://news.ycombinator.com/item?id=29947396

tptacek 5y ago

This is just leaking the names of indexdb databases, right? Like, it's a particularly useful fingerprinting technique. It's not dumping your history or anything?

olliej 5y ago
Correct. It’s clearly a not great bug, but historically (by design) you could get more information via CSS. The only increase is trackability is extracting the google id because I guess google includes that in the db name??
- wutwutwutwut 5y ago
  Why would you have to guess when the source describe it. Anyway, funny how you mention "only"- the "only" increase in trackability is to be able to retrieve user information about users using the world's most popular online services. I don't want pornhub to be able to view my photo from Google. Comparing this to CSS fingerprinting seems misinformed at best.
  - sa1 5y ago
    I might be misunderstanding you, but it's a leak of database name, not database contents. You can tell someone visited a website by looking at the name, but your photo from Google is safe.
    - wutwutwutwut 5y ago
      I'm so confused now. Did you read about the issue? I wonder if I misunderstood maybe. As I understand it: According to the source, Google inserts unique user ID is into database name. An attacker can make a request to Google, pass in this unique user ID into their API and get profile details, for example a photo back. The attacker does not need access to the database data, only the database name, since the user ID is embedded in the _name_. You are right it's a leak of a database name, but Google store sensitive data in the database name.
      - sa1 5y ago
        My reading was that a user can be identified by the userid. I'm not sure what other actions just having an userid authorizes, but I would lay that bit on google.
        wutwutwutwut 5y ago
        Safari leaks very sensitive information (database names) and its on Google? That's bizarre.
        sa1 5y ago
        There are clearly two issues here, only the first one of which has been demonstrated. One is the leak of database names, which is on Apple. The other one is releasing sensitive data on insufficient authorisation(just an user id), which would be on google.
    - tinus_hn 5y ago
      Google allows attackers to retrieve the profile picture of accounts if they know the account name, which they can retrieve using this bug.

danhab99 5y ago

Safari is switching to chromium just like edge. We all know it, let's just cope with it and move on.

deleted 5y ago
[deleted]
tata71 5y ago
They are? Evidence?
mrtesthah 5y ago
Did you hear? MAC’s operating system is really just Windows. MAC never even had their own OS they just stole it from Bill Gates in 1995. I hear Microsoft is going to buy MAC soon because the new IMAXES are slower than Pentium. LOL PC PWNS MAC STEVE JOBS IS LOSER.