A Closer Look At Chromium and Browser Security

GhostX9 writes "Tom's Hardware's continuing series on computing security has an interview with Adam Barth and Collin Jackson, members of Stanford University's Web Security Group and members of the team that developed Chromium, the open-source core behind Google Chrome. The interview goes into detail regarding the sandboxing approach unique to Chromium, comparisons between the browser and its competition, and web security in general."

Comments

Good

[maz2331]

These are all great ideas, and I hope Firefox and/or MSIE pick up on them, simply because I can't stand the Chrome UI.

Sorry, but that thing just isn't what a browser is supposed to be.

The uhderlying technology can be the greatest ever, but if the interface sucks, well, I won't use it.

Re:Good

[mhousser]

I love the interface! What I don't love, however, are the millions of ads that I forgot existed. I'll move to Chrome the minute it supports plugins and AdBlocker is ported to it. Chrome's plugin API will be finished later this year.

Re:Good

[Anonymous Coward]

It supports greasemonkey scripts if you append --enable-user-scripts to its shortcut. And theres a script for it that works exactly like adblock.

Re:Good

[Anonymous Coward]

The uhderlying technology can be the greatest ever, but if the interface sucks, well, I won't use it.

That describes in a nutshell why OS/2 never caught on big.

Re:Good

[Genocaust]

I like others, also love the UI. It took some getting used to over Firefox, but I do like the clean look of being able to focus on actual content -- not the browser itself.
As to Adblock, yeah, wow, there are a lot of ads out there I didn't even know existed! Using OpenDNS I manage to block most of them just by domain through their blacklist service, though. It's not perfect, but better than nothing for now!

Re:Good

[cryptoluddite]

Chromifox makes firefox look a lot like Chrome. Chrome is a nice toy, but it's UI is pretty lacking when you want to do something like maximize screen space on a 1024x600 screen.

Re:Good

[i.of.the.storm]

There is actually something handy called AdSweep that works with Chrome, but it's not regex based like Adblockplus so it seems to only work on sites that are built into it. It's better than nothing, I guess, but there are still about 300 other things that Firefox does for me that Chrome is far from doing, and a lot of them hinge on a good extension platform. I just don't think it can get better than XUL/js for extension writing.

Re:Good

[PopeRatzo]

Maybe instead of complaining about a browser that displays ads, you might want to stop visiting websites that have intrusive and overwhelming ads.

I use Slashdot and Chrome and don't see any ads because I'm a subscriber, but even if I wasn't, the low number of ads here is one reason I like it.

Re:Good

[drolli]

Insightful? The OS/2 interface was extremely consistent and extremely configurable. e.g. make a template for a file which containe certain context menu options. etc...

Re:Good

[Anonymous Coward]

I've always felt that the OS/2 UI was far superior to the Windows versions of the time (3.x/95). Heck, it makes more sense to me then Windows Vista/7 does.

Re:Good

[similar_name]

My biggest complaint about the interface is it unnecessarily creates its own window/title bar. As such I can't use RBtray on it to keep Chrome windows 'always on top'. Which I like to do so I can stick a hulu window in the corner of my screen while I'm browsing.

Re:Good

[cbrocious]

If you use Privoxy, the majority of those ads will go away, and you can do custom filtering for fun and profit easily.

Re:Good

[cryptoluddite]

In firefox I can go full screen, but still keep the URL bar, so I know what site I'm on. I can get a menu bar by pressing Alt once. I can put the NoScript button on the URL bar. I can even put a button to toggle fullscreen, since it's often easier to trackpad to a button than find F11 on a small non-backlit keyboard. Or firefox can drop down this UI when the cursor is at the top.

Chrome can do none of these things, even in the current beta version. The UI in many ways is restrictive and lacks many niceties. You can still like it and prefer it, that's fine, but let's be honest. Perhaps I should have said "maximize space while still being usable", but some common sense is in order here.

Re:Good

[coryking]

UI is the easy part.

Yeah, right. If the UI was the easy part, why do almost all UI's suck?

skinning

If you think skins are gonna fix a UI, I've got news for you. Having the ability to add girls sitting on the hoods of of cars wearing tightly clad bikinis does not make a good UI.

Re:Good

[voidphoenix]

Gmail is also great. Simple, secure, and uncluttered. Create an app icon and add it to the start menu, and you have a very simple email solution. The only problem I have though is their grouping of threads, which is unnecessary. That should be a lab feature if any. And why can't they just add folders? Who cares which is better. Some people just want folders, not labels, and if its so easy to give it to them, denying it is selfish. Just give it up, and give people what they want!

Labels can work _exactly_ like folders if that's all you want. The main difference is that a message can be in more than one "folder" if you need it to be.

Re:Good

[Bert64]

I used to run a browser in a chroot on linux, partly because i had a 64bit system but needed some 32bit plugins (java, flash) and partly for the security benefit...
In terms of user files, you simply leave them in the sandbox, the host system can access the sandbox but the sandbox can't access the host which is how it should be.

Re:Good

[asdf7890]

OK, let's here it: why is user scripting a security hole?

With early versions of GreaseMonkey, the way the user scripts were applied to pages would allow the page to affect easily the GM in ways that could lead to cross-site attack vectors.

That is why GM had a fairly complete redesign around the middle of 2005, remove the issue(s) that affected all scripts, but individual scripts can still be vulnerable depending on their design - hence you should be careful not to let a script apply globally for security reasons as well as efficiency ones. For a decent description of the problems with earlier GM versions and problems that you can still create for yourself in the latest versions, this article does a decent job.

The other major problem with user scripting is using scripts from other sources without performing an exhaustive code review first. How do you know that the script you have just enabled isn't subject to one of the flaws? How do you know it isn't intentionally malicious? There have been several cases of this in the past, hence the warning message before you add a script to GM in recent versions and the warning message that appeared on userscipts.org for some time (as malicious scripts were found in their archive).

Like many things, user scripting isn't a problem if both programmers and users are educated, careful and care. There lies the problem.

I use GM myself, with scripts of my own devising or those from elsewhere that I have sufficiently reviewed, but I would not recommend it (or equivalents) to the general populous as they do not need any further ways to dig themselves into a malware riddled hole.

Adblock for Chrome -- Use SwWare Iron "Chrome"

[blahbooboo]

Srware Iron is Chrome compiled without all the Google spyware crap and it has adblock built in.

I LOVE IT! Firefox (all versions) is sooooo slow compared to Chrome/Iron.

http://www.srware.net/en/software_srware_iron.php

Re:Adblock for Chrome -- Use SwWare Iron "Chrome"

[sortius_nod]

So what about its adblock, the thing doesn't render pages correctly. From what I can tell it is a badly compiled version of chrome.

When they get it right, then I might think about using it... uninstall time.

Re:Adblock for Chrome -- Use SwWare Iron "Chrome"

[blahbooboo]

So what about its adblock, the thing doesn't render pages correctly. From what I can tell it is a badly compiled version of chrome.

When they get it right, then I might think about using it... uninstall time.

I get some weird font smoothing occassionally on Slashdot, otherwise works perfectly for me. It's so blazing fast when I go back to Firefox I am shocked how agonizingly slow the browser is to render pages...

Re:Adblock for Chrome -- Use SwWare Iron "Chrome"

[mcrbids]

rware Iron is Chrome compiled without all the Google spyware crap and it has adblock built in.

Unfortunately, they don't have a download in RPM or source form, so I can't install it on my Fedora Core 10 laptop.

Without *nix support, Chrome(ium) is a non-starter.

Re:Adblock for Chrome -- Use SwWare Iron "Chrome"

[blahbooboo]

Thanks for the link man. I'm sick of firefox cause of its slowness, but I was also getting sick of Chrome, so this should be a good alternative.

Does anyone have the following problems I have with Chrome?

(1) It freezes up continually, and when it does freeze up, it effects the entire computer.

(2) When accidently clicking on a PDF link the entire thing crashes, and computer freezes up.

I love chrome cause of its speed, but goddamn. The amount of restarts of my computer I've had with it I'm seriously looking for another browser (NOT firefox).

Are you using Adobe Acrobat for PDFs? That's likely your problem and not the browser.

Uninstall that crap and use Foxit PDF Reader instead.

Re:Adblock for Chrome -- Use SwWare Iron "Chrome"

[Ian Alexander]

http://www.srware.net/en/software_srware_iron_download.php

It's the last two download links. Good luck compiling it on F10 since it looks like a Windows app...

Google Main Page Says To Use Chrome Only In IE

[Anonymous Coward]

When I go to the main google page in IE 8, it has this huge icon telling me to use Chrome in the top right corner. When I go there in FF, its not there. Is google singling out IE users?

Re:Google Main Page Says To Use Chrome Only In IE

[Tacvek]

Perhaps. My guess is they have logic like the following:

If you use Firefox, you probably already have heard about Chrome, and have decided not to switch. If you use IE, you probably have no idea that other browsers even exist, but you may know and like Google, so would be willing to give this Chrome thing a try.

Re:Google Main Page Says To Use Chrome Only In IE

[Anonymous Coward]

Or maybe they just wrote the page such that standards-compliant browsers won't show the advert.

Re:Google Main Page Says To Use Chrome Only In IE

[Anonymous Coward]

Of course they are!

Firefox has the "Tell me if the site I'm visiting is a suspected attack site" option checked by default. (Tools --> Options --> Security) This option sends every site one visits to Google for verification, so Google is already getting a complete history of each site visited for FF users. [IE sends this information to Microsoft.]

Thus, Google has more incentive to switch an IE user to Chrome than a FF user.

Re:Google Main Page Says To Use Chrome Only In IE

[Anonymous Coward]

I am sorry but that's incorrect. Firefox uses a local database of suspicious URLs that is updated every 30 min. URLs are never send to Google, Google sends suspicious URLs to Firefox.

The functionality you describe was optional in older versions of Firefox (to eliminate the max 30 min. delay for ultra paranoid people) but was removed on request of Google because it caused them too much load.

Not so good. Time to make gooder.

[JavaManJim]

I like Chrome's Home Page web thumbprints.

I dislike that I cannot control these. For example right now, I have two timesonline.uk up. Permanently it seems. The "tool" icon does not allow Home Page editing. It should.

So,
A. If anyone out there can enlighten me on how to adjust Home Page icons. Go ahead.
B. If not Chrome developers, are you listening? Add web page adjustments to the Home Page. Pretty please?

Thanks

Re:Not so good. Time to make gooder.

[Anonymous Coward]

The current dev branch of chrome just added support for adjusting thumbnails of new pages.

Re:Sandboxing lie...

[downix]

Have you read the article, where he discusses IE7, IE8, Firefox and Safari's own sandboxing techniques for comparison to Chromes?