5 ms·
Serious answer, don't use Safari. Use a browser that properly separates webpages into isolated processes so that this kind of cross-site read is not possible.
by omcnoe 2y ago
Serious answer, don't use Safari. Use a browser that properly separates webpages into isolated processes so that this kind of cross-site read is not possible.
- amelius 2y agoWill that work? Isn't memory treated in a unified way between processes, at some point?
- goldsteinq 2y agoIt will work unless someone forgets to add a public suffix into the public suffix list (as described in the FLOP paper). Both of these attacks target virtual memory pointers.
- saagarjha 2y agoProcessors are not supposed to speculate across ASIDs
- goldsteinq 2y agoThere’re no other browsers on iPhone. Every iPhone browser is a reskin of Safari. They’re in theory supposed to allow other browsers in the EU, but AFAIK it has not happened yet.
- ragnot 2y agoGod I hate Apple sometimes
- prmoustache 2y agoThen don't use an iPhone until it is patched.
- hashstring 2y agoWhat about turn JS off on your favourite iOS browser?
- prmoustache 2y agoThat wouldn't prevent possible malware apps using WKWebview from getting out of the jail they are running out right?
- hashstring 2y agoYes, I agree. However I also expect that Swift-compiled apps can do this without a web browser component. It’s a different threat model though, having installed a malicious app vs browsing a malicious site.
- prmoustache 2y agoWhich is the reason alongside telemetry I tend to favor using websites over apps. Having said that there are apps that are considered mainstream and not malicious by the general population but can become a convenient backdoor for, say, a state actor.
- tholdem 2y agoNo need to turn JS off. Turn on Lockdown mode which disables Javascript JIT and WASM, which might be enough
- saagarjha 2y agoIt’s not.
- walterbell 2y ago
- jmkni 2y agoSo could this hypothetically open a mail client on your iPhone and read your emails?
- saagarjha 2y agoNo, it doesn’t do cross-address space attacks.