Slashdot Mirror
Chrome Apes IE8, Adds Clickjacking, XSS Defenses
CWmike writes "Google has announced that it added several new security features to Chrome 4, including two security measures first popularized (some later shot down as having 'zero impact') by rival Microsoft's IE8 last year. The newest 'stable' build of Chrome includes five security additions that target Web developers who want to build more secure sites, said Adam Barth, a software engineer on the Chrome team. The two aped from IE include 'X-Frame-Options'" a security feature that helps sites defend against 'clickjacking' attacks, and cross-site scripting protection.'"In Google Chrome 4, we've added an experimental feature to help mitigate one form of XSS [cross-site scripting], reflective XSS,' Barth said. 'The XSS filter checks whether a script that's about to run on a Web page is also present in the request that fetched that Web page. If the script is present in the request, that's a strong indication that the Web server might have been tricked into reflecting the script.'"
Thanks for adding the security features to Chrome, developers at Google. That is all.
Always proofread carefully to see if you any words out.
Anyone else getting flashbacks from Planet of the Apes?
Is that the new code name for the next version of Chrome? Ubuntu Panhandling Panda, now featuring Chrome Apes! Download now! Steve Balmer your Monkey Boy days are numbered, so dance while you can, it's the year of the Google Desktop.
These posts express my own personal views, not those of my employer
G4yfield P3nishands is a touching film about a 29 year old g4y emo man, with long p3nises for fingers. In the tradition of Edward scissorhands, we bring you:
G4yfield P3nishands
Watch as G4yfield stumbles around in his world where his p3nis fingers get him in all sorts of michief. With every simple sneeze, volcanic mayonnayse storms erupt.
Will G4yfield P3nishands live a fruitful life? Is he to find love?
g4y emo man
No Wynona Ryder.
FAIL.
security by obscurity... just imagine how many developers will be baffled by this behavior, spending hours trying to find out what is wrong with their code...
I'm interested into how this ties in with commonly used external scripts, such as the jQuery and Yui frameworks which are commonly fetched from their respective servers, rather than hosted locally on the server of the website, so they're cached etc.
Recently I starting doing a bit of web development after being out of the loop for a while. I was working on a project and it was convenient to have the XHTML / JS running on my development machine while doing a few AJAX calls to my development server. After it failed at first I found I could add Access-Control-Allow-Origin: * to the HTTP header to allow cross-site access.
It made we wonder if you wanted to exploit cross-site vulnerabilities couldn't you setup a proxy in the middle that returned information from the original site but added that to the header? Anyway just got me wondering and maybe someone more knowledgeable could comment on it.
A few potentially good ideas somehow changes a decade of standards abuse and generally shitty security? I hope the submitter realized that the only reason MS even bothered with any of this is thanks to them getting an ass pounding over the last few years for not giving a shit about security. Your welcome MS drones.
Off topic? The summary is pure troll.
Hi, do you want to convert your M2TS files created by your Sony Camcorder and enjoy them on your Mobile Phone? With this powerful M2TS Converter to convert m2ts to mp4 Really nice software, just have a try now.
Defenses
I like how Slashdot renders that headline.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Oh my god Chrome is copying IE by supporting for the http header X-Frame-Options that Microsoft wants web developers to start using. Don't they know you're supposed to invent your own browser-specific variation of what your opponent implements?
I also like how they mention Chrome added 5 security features but they only cover the 2 that are already in IE.
It's nice that all of the browsers are adding security features but can we cover one of them without focusing on who did what first?
This post of NoScript's author Giorgio Maone dates back to one year ago and goes into the details of X-Frame-Options. His point seems to be that if you have JavaScript enabled, there are well-known ways to achieve the same result, unless you use IE (they can be circumvented). If you don't have JS enabled, NoScript on Firefox is already giving you the same degree of protection. Anyway (this is me) adding that level of protection by default on all browsers looks a nice thing to have.
If Chrome can't block ads it's not ready for the internet. It doesn't matter what else it does and doesn't do, blocking stupid flashing graphics is the main function of web browsers these days.
...when Google goes ahead, tracks your every move, and sells it to the same crooks anyway?
(Not trolling here. As far as I heard, Google does track everything. And as far as I know, Google does sell that information to advertisers as its main business. Finally, as far as I know, those advertisers include all those spamming crooks and their friends.)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
I have Adblock and a ton of other extensions working just fine in Chrome. Just use the testing / developer streams which have plugin support.
Chromium blog post on the new security features, some of which are rather interesting
formed his own company a 2 I know i7 sux0rs, survey which [idge.net] things 1n YOU CAN. WHEN THE
... and the twitter icon as well, appearing on every story and even on my own journal:
fuck off Slashdot.
What's "late" about it? This isn't a fix for a security hole, it's a heuristic that helps cut down on some attacks. There is no strict need to implement it, it's just a "would be nice" feature.
Mod parent up please, very informative!
Can anyone tell me whether it finally installs in 'program files', on Windows XP? I haven't been able to find a way with the previous versions, and this is my only hurdle to installing it on my work PC due to the anti-virus rules.
Jumpstart the tartan drive.
I stopped using Chrome. It comes from a supplier that sees privacy as a problem, and I don't feel I have enough control over what it does with the information it gains from my surfing - that's also why I don't use Google DNS. I also have no idea how to switch the "referrer" information off (in FF that's quite easy).
So, personally I don't give a damn what Chrome (or any other Google app) does. I prefer FF, even when I switch to OSX later this year (yes, I'm switching control freaks :-))..
Insert
Improving security is great, but they really need to keep working on usability as well! I just installed Chrome for the first time yesterday and have been playing around with it. It seems pretty speedy but the UI is a bit weird.
The lack of a title bar seems kind of weird. I don't know what they were going for with that, but it's the only window on my entire machine and it stands out, and not in a good way. At one point i tried adding a new tab while waiting for visual studio to start a debug session, and the UI hung up for a little bit, and for a few brief seconds Chrome acquired a title bar. I actually thought it looked better that way. A couple minor aesthetic gripes. I may eventually get used to having the tab bar above the toolbar, though currently it seems pretty funky to me.
I haven't done a side-by-side comparison with Firefox yet, but my initial rough estimates seem to be that Chrome uses at least 75% as much memory as Firefox, possibly more, and at least as much virtual memory. I find the fact that Chrome has about 40 process running right now to be rather awkward, but hopefully it at least means that when i start closing large numbers of tabs that the memory will actually be released (unlike Firefox.)
The biggest problem however is the tab bar. Personally i don't like having new tabs open in the middle of the bar, screwing up the ordering, but it was easy to find an extension to fix that behavior. However if you open up a lot of tabs they just get smaller and smaller until you can't see what each of them is anymore. And to my further frustration there's no way to access a list of the tabs. There are a couple extensions that offer some kind of tab index, but nothing that presents a simple list like in Firefox.
After a little searching i found out the reason for these problems in a Chromium blog post. The designers are approaching the UI design from a heavily aesthetic angle. Which is good in theory, but they're also being fanatical about it. If they don't think a feature is aesthetically correct but can't think of a more aesthetically pleasing way to implement it they just won't implement the feature at all, even though they admit that the lack of that feature causes usability problems!
And to wrap it all up, they say "In all of these areas we've resisted adding options to control behavior. Keeping our set of options minimal is a good forcing function for us as user interface designers to come up with the right approach, since we never rely on the crutch of making the user decide what we were unable to."
Well i hate to tell you guys, but it doesn't seem to be working really well as a "forcing function" given that you've crippled an important part of the UI while dithering about what the "best" way to implement it is. The blog post was made a year ago and they apparently still haven't found a solution! And i find it very aggravating that they feel once they've come up with the "right" approach they don't want to provide options to do it any other way. Clearly if the user has a different aesthetic sense than the designer then the user is wrong! I've dealt with designers like this on projects before, and trying to convince them that the users can legitimately have a different opinion is a very frustrating task.
I remember the painful process of Firefox developers trying to get their tab bar into a useful state under similar circumstances. Perhaps their solution isn't 100% aesthetically appealing to the Chrome designers, but it undeniably _works_, and leaving the users hanging while they try to figure out something more "aesthetically" and "spatially" pleasing seems like pure egotism to me.
This Space Intentionally Left Blank
By this time next year we will be on Chrome Version 17!
Curious about Storage and Virtualization? Check out