4 ms·

I wonder if it really doubles the attack surface area.

aarongough 17y ago
I was wondering that too when I read the article. If Chrome Frame works the way I understand it does, with Chrome basically sitting in the rendering area of IE, taking UI commands from it and interpreting all the incoming markup/code itself then I would have to guess that the answer is no. The only public facing interface should be Chrome's, but I'd have to do a bunch more research to confirm that for sure...
- tomjen2 17y ago
  If the attacker wasn't stupid, it would double it. If he has an exploit for chrome, he is going to add the magic tag and let ChromeFrame render the code thus the browser is vulnerable. If he has an exploit for IE, he isn't going to add the magic tag, IE's engine is going to handle the rendering and the browser is vulnerable. The key is that the attacker can choose what browser the victim is using, thus he can target either browser.
  - aarongough 17y ago
    Ah, I hadn't realized that the individual website had control over whether Chrome Frame was used or not... That is a terrible idea. If the user elects to install Chrome Frame it should render every page except for exceptions set at the user's discretion. I absolutely agree. Letting the website choose is just adding attack vectors.
    - enomar 17y ago
      It also ensures that sites that only work in IE continue to work. Google Frame simply lets someone visit sites that only work in IE and sites that need HTML5 without having to know which browser to use for which site. Having the site control when GF is used is essential for this to work.
      - aarongough 17y ago
        I understand the reasoning behind that, but ultimately it should be the user not the website that has control over whether Chrome Frame is activated or not. A user can always visit an IE-only website in FireFox, so it's not creating a new problem there. Allowing the user control, rather than the website, means the user will get the benefit of Chrome Frame by default rather than as the exception and will stop a potential attacker from getting to choose their attack vector...
NathanKP 17y ago
Personally I would propose that it would halve the attack surface area. When you have two browser's worth of security at work then something that slips through IE might get caught by Chrome. In my mind having two browsers would be an advantage security wise.
- icey 17y ago
  They don't have to exploit both browsers. They just have to exploit a browser. Their argument is that you now have 2 potential entry points for attack instead of 1.

I was wondering that too when I read the article. If Chrome Frame works the way I understand it does, with Chrome basically sitting in the rendering area of IE, taking UI commands from it and interpreting all the incoming markup/code itself then I would have to guess that the answer is no. The only public facing interface should be Chrome's, but I'd have to do a bunch more research to confirm that for sure...

tomjen2 17y ago
If the attacker wasn't stupid, it would double it. If he has an exploit for chrome, he is going to add the magic tag and let ChromeFrame render the code thus the browser is vulnerable. If he has an exploit for IE, he isn't going to add the magic tag, IE's engine is going to handle the rendering and the browser is vulnerable. The key is that the attacker can choose what browser the victim is using, thus he can target either browser.
- aarongough 17y ago
  Ah, I hadn't realized that the individual website had control over whether Chrome Frame was used or not... That is a terrible idea. If the user elects to install Chrome Frame it should render every page except for exceptions set at the user's discretion. I absolutely agree. Letting the website choose is just adding attack vectors.
  - enomar 17y ago
    It also ensures that sites that only work in IE continue to work. Google Frame simply lets someone visit sites that only work in IE and sites that need HTML5 without having to know which browser to use for which site. Having the site control when GF is used is essential for this to work.
    - aarongough 17y ago
      I understand the reasoning behind that, but ultimately it should be the user not the website that has control over whether Chrome Frame is activated or not. A user can always visit an IE-only website in FireFox, so it's not creating a new problem there. Allowing the user control, rather than the website, means the user will get the benefit of Chrome Frame by default rather than as the exception and will stop a potential attacker from getting to choose their attack vector...

NathanKP 17y ago

Personally I would propose that it would halve the attack surface area. When you have two browser's worth of security at work then something that slips through IE might get caught by Chrome. In my mind having two browsers would be an advantage security wise.

icey 17y ago
They don't have to exploit both browsers. They just have to exploit a browser. Their argument is that you now have 2 potential entry points for attack instead of 1.