Slashdot Mirror
Genius' Web Annotations Undermined Web Security (theverge.com)
New reader BradyDale shares an article on the Verge: Until early May, when The Verge confidentially disclosed the results of my independent security tests, the "web annotator" service provided by the tech startup Genius had been routinely undermining a web browser security mechanism. The web annotator is a tool which essentially republishes web pages in order to let Genius users leave comments on specific passages. In the process of republishing, those annotated pages would be stripped of an optional security feature called the Content Security Policy, which was sometimes provided by the original version of the page. This meant that anyone who viewed a page with annotations enabled was potentially vulnerable to security exploits that would have been blocked by the original site. Though no specific victims have been identified, the potential scope of this bug was broad: it was applied to all Genius users, undermined any site with a Content Security Policy, and re-enabled all blocked JavaScript code. Vijith Assar dives deep into how Genius did this :The primary way Genius annotations are accessed on the web is by adding "genius.it" in front of any URL as a prefix. The genius.it server reads the original content behind the scenes, adds the annotations, and delivers the hybrid content. The Genius version of the page includes a few extra scripts and highlighted passages, but until recently it also eliminated the original page's Content Security Policy. The Content Security Policy is an optional set of instructions encoded in the header of the HTTP connection which tells browsers exactly which sites and servers should be considered safe -- any code which isn't from one of those sites can then be ignored.
How does this affect anyone? I don't use Genius. I don't know anyone who uses Genius. I'm sorry that three people had their web security undermined but how is this a story? I'm sure I'll get censored to -1 for asking this, but it needs an answer. Don't pretend this doesn't exist by modding it down. Give a legitimate answer. But I doubt anyone will do so.
Easy fix: continue to ignore genius.it. Or just put "sh" in front of the "it" to get a better result.
They are not keeping a copy of the webpage on their servers, merely playing man-in-the-middle by creating the link to the page, opening it in the user's browser and applying their own data (highlighting) into the HTML using their own scripts.
Which is exactly what CSP is suppose to stop (not allowing third-party sites to run unauthorized cross-domain scripts).
So, isn't the site's concept itself an affront to Content Security Policies? Maybe sites that require strict CSP should just block redirects from Genius.it.
This article is from 20 years after 2012 ...
You sign up for services that appeal to "Geniuses".
Genius may not have enough users to make this a major story. However, MOST users access major CDN networks, which have the same types of problems. So the issue effects everyone, Genius is just a small example.
One well-known CDN doesn't include the query string in its caching, so when the user requests google.com?q=its+ass the CDN will return the page cached for google.com?q=a+hole+in+the+ground . This CDN literally doesn't know its ass from a hole in the ground.
The lesson to be (re)learned, I think, is "don't write an http proxy without reading and following the http RFC on proxies". Most of the time when people write web proxies, they'd be better of configuring an existing proxy such as squid to do whatever they want to do. Squid will take care of doing the right thing for an http proxy, then add whatever function you want your proxy to do. If you absolutely must write your own http proxy, read and follow the RFC.
Title should be "Genius's Web Annotations." "Genius'" would only be correct if "genius" were a plural. Singular nouns that end in s get an "apostrophe s" after them to indicate the possessive. /pedant
infojobs.com.br claim hiring high profile users, but it's bunch of trolls trying to sell premium accounts, using reverse psychology to fright the users. whose country would hire special operators, like NSA shit stuff, through a PHP website??????????
There was a company who did the same in 1998-ish.. can’t remember the name.. Went belly up with the rest of the shitty tech-bubble companies..
Obviously, this is some serious web 3.0 shit
This sounds more like security theatre if I understand this right. The browser shouldn't trust any site period. Accessing site X shouldn't any more or less dangerous than accessing site Y. If either X or Y can do something malicious to your computer then the problem is with your computer. Not the site. Unless we're talking about something like a user visiting site Y through site Z and Z passes data to site Y insecurely. The problem there though seems as though it is with the end-user. If site Z is controlled by site Y though then I can see the issue. If your using some third party site (Z) to access site Y (like via a proxy) then the issue is with the third party site or your use of that product thereof.
I wrote a PhD on this technique as a way to support collaborative learning by allowing third-party annotation sharing: http://ethos.bl.uk/OrderDetails.do?uin=uk.bl.ethos.431525
In essence, the only way to do this without storing a copy of the original page (which has merit, but is challenging legally and in terms of disk space), is to store the annotations, pull in the page and then merge the annotations and send the output to the viewer. So it is basically acting as a proxy, but means that there are potential issues with orphaned annotations - the more dynamic nature of the web today would cause real problems in getting any kind of consistent output for two different people, or even for the same person at different times. I have to admit, I was looking at the educational side of things and so the security issues were less of a consideration, but things like the injection of malicious code, invisible amendments (e.g. censorship) to the underlying text, etc. were all pretty obvious.
Anyway, the technique itself was far from novel when I started working on my PhD, but given the continued citations to papers that I published back (https://scholar.google.co.uk/citations?user=KK_EFSUAAAAJ&hl=en) then it seems to still be an area of active research.
A "vulnerability" implies that there is a problem that makes somebody vulnerable to something. Who is vulnerable to what in this case?
Here's what won't happen: you won't give your login credentials to a third party. That's because your browser won't read any cookies from the original site, and Genius prevents you from typing into web forms.
The author uses technical language without talking about what people do, how people interact, and what people care about. Instead, there's much ado about a variable called "clickjacker" -- eliding the fact that www.theverge.com installs a slew of clickjackers of its own. Is Genius evil because of a variable name?
Let's find out how Genius' CSP changes can affect human beings, THEN write 3,000 words about it.
so they strip tags, which would prevent their copy from loading content like images from the original server? So what? That's needed for operation. And i guess nobody would actually annotate their online banking or webmail pages.