Conversation

Notices

1. MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Thursday, 15-Sep-2016 20:59:51 UTC MMN-o ✅⃠

   • Computer and Network Security
   A good !security browser plugin would be caching sha256/512 of remote javascript files and do a trust-on-first-use. If updated it would require manual activation.
   • Claes Wallin (韋嘉誠) and @mcscx@quitter.se like this.
   • Claes Wallin (韋嘉誠) repeated this.
   • zoowar (zoowar@indy.im)'s status on Thursday, 15-Sep-2016 21:41:14 UTC zoowar

     in reply to
     When was the last time you didn't apply an update?
     Claes Wallin (韋嘉誠) likes this.
     Claes Wallin (韋嘉誠) repeated this.
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Friday, 16-Sep-2016 06:39:12 UTC MMN-o ✅⃠

     • zoowar
     It's more about being aware that things change. And combined with, say, comparing version numbers (jquery version x.y.z shouldn't change hash, and x.y.z++ would be trusted on first use).
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Friday, 16-Sep-2016 06:41:17 UTC MMN-o ✅⃠

     in reply to
     That means googleapis.com or whatever can't silently deliver me different files if they get hacked or MITM'ed (and I assume I trust the URLs linked on the site I visit via NoScript interaction).
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Friday, 16-Sep-2016 06:49:57 UTC MMN-o ✅⃠

     • zoowar
     In this case I'm not the one applying updates. All the CDN based script embeddings are made with version numbers in the URL. The attack vector is an evil server thah will serve different files depending on refererer/client/randomness".
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Friday, 16-Sep-2016 08:01:43 UTC MMN-o ✅⃠

     • zoowar
     @zoowar Idea is:
     1. I visit random .se website that doesn't think they need a CDN. They embed a third party link to googlewhatever.com for jquery-v1.3.37.js
     2. googlewhatever.com is backdoored by whateveragency or malicious third party hacker that manipulated their way to a Verisign *.com certificate and can MITM me at the Tor exit I use.
     3. They only do it very rarely, once in a thousand requests. Which changes the javascript and I notice that "hey, this is the same version as before - but updated? that can't be right!".
     
     Go to any hipster web 2.0 website and they'll link crap to random third party sites. Anything from my local municipality to Wikimedia SE's projects and anything else that doesn't have a fulltime staff to run a distributed CDN but buy into the idea that the web should load in milliseconds instead of centiseconds.
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Friday, 16-Sep-2016 08:04:53 UTC MMN-o ✅⃠

     in reply to

     • zoowar
     @zoowar That is, most sites I visit which incorporate third party .js links will likely not be targeted by malicious hackers - but instead they can target the googleapis.com domain etc. and deliver a payload through there.
   • Temporary Marjolein (mk@oracle.skilledtests.com)'s status on Friday, 16-Sep-2016 08:28:38 UTC Temporary Marjolein

     in reply to

     • zoowar
     @mmn @zoowar the problem I see with this reasoning is that google (googlewhatever.com ?) _is_ a CDN - for a large number of widely-used libraries, including jQuery. And you don't need 'staf' to'run' a CDN, you just use one (paid-for or free)
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Friday, 16-Sep-2016 08:51:56 UTC MMN-o ✅⃠

     • zoowar
     @zoowar It'd be fun to implement something that, with a plugin that tracks content hash sums, can interpret and prioritise hashsrc="sha256:1234...cdef"
   • MMN-o ✅⃠ (mmn@social.umeahackerspace.se)'s status on Friday, 16-Sep-2016 09:21:19 UTC MMN-o ✅⃠

     • zoowar
     @zoowar because I didn't know about it, thanks!