Forgot your password?
typodupeerror
Google Internet Explorer Technology

Chrome Apes IE8, Adds Clickjacking, XSS Defenses 90

Posted by timothy
from the damn-dirty-apes dept.
CWmike writes "Google has announced that it added several new security features to Chrome 4, including two security measures first popularized (some later shot down as having 'zero impact') by rival Microsoft's IE8 last year. The newest 'stable' build of Chrome includes five security additions that target Web developers who want to build more secure sites, said Adam Barth, a software engineer on the Chrome team. The two aped from IE include 'X-Frame-Options'" a security feature that helps sites defend against 'clickjacking' attacks, and cross-site scripting protection.'"In Google Chrome 4, we've added an experimental feature to help mitigate one form of XSS [cross-site scripting], reflective XSS,' Barth said. 'The XSS filter checks whether a script that's about to run on a Web page is also present in the request that fetched that Web page. If the script is present in the request, that's a strong indication that the Web server might have been tricked into reflecting the script.'"
This discussion has been archived. No new comments can be posted.

Chrome Apes IE8, Adds Clickjacking, XSS Defenses

Comments Filter:
  • Thanks for adding the security features to Chrome, developers at Google. That is all.
    • Would I have been so forgiving if it were IE that were late with their security additions?
      • Would I have been so forgiving if it were IE that were late with their security additions?

        I dunno... though I also dont know if this security addition works in IE8 either... ;-)

    • I hope this new Chrome security works on the clickjacking on google's own SERPs.

  • by syousef (465911) on Friday January 29, 2010 @04:17AM (#30946958) Journal

    Anyone else getting flashbacks from Planet of the Apes?

    Is that the new code name for the next version of Chrome? Ubuntu Panhandling Panda, now featuring Chrome Apes! Download now! Steve Balmer your Monkey Boy days are numbered, so dance while you can, it's the year of the Google Desktop.

    • http://www.google.co.uk/search?q=define%3A+ape [google.co.uk]

      # any of various primates with short tails or no tail at all
      # imitate uncritically and in every aspect; "Her little brother apes her behavior"
      # copycat: someone who copies the words or behavior of another
      # caricature: represent in or produce a caricature of; "The drawing caricatured the President"
      # anthropoid: person who resembles a nonhuman primate

      You can thank me for the free English lesson later.

      • by syousef (465911)

        What is wrong with people? I made a joke, and they assume I don't understand the context? WTF?

  • Cross-site scripting (Score:5, Interesting)

    by commlinx (1068272) on Friday January 29, 2010 @04:58AM (#30947138) Journal

    Recently I starting doing a bit of web development after being out of the loop for a while. I was working on a project and it was convenient to have the XHTML / JS running on my development machine while doing a few AJAX calls to my development server. After it failed at first I found I could add Access-Control-Allow-Origin: * to the HTTP header to allow cross-site access.

    It made we wonder if you wanted to exploit cross-site vulnerabilities couldn't you setup a proxy in the middle that returned information from the original site but added that to the header? Anyway just got me wondering and maybe someone more knowledgeable could comment on it.

  • Defenses

    I like how Slashdot renders that headline.

  • Dumb article (Score:5, Insightful)

    by Undead Waffle (1447615) on Friday January 29, 2010 @05:55AM (#30947388)

    Oh my god Chrome is copying IE by supporting for the http header X-Frame-Options that Microsoft wants web developers to start using. Don't they know you're supposed to invent your own browser-specific variation of what your opponent implements?

    I also like how they mention Chrome added 5 security features but they only cover the 2 that are already in IE.

    It's nice that all of the browsers are adding security features but can we cover one of them without focusing on who did what first?

  • by pmontra (738736) on Friday January 29, 2010 @06:31AM (#30947514) Homepage
    This post [hackademix.net] of NoScript's author Giorgio Maone dates back to one year ago and goes into the details of X-Frame-Options. His point seems to be that if you have JavaScript enabled, there are well-known ways [wikipedia.org] to achieve the same result, unless you use IE (they can be circumvented). If you don't have JS enabled, NoScript on Firefox is already giving you the same degree of protection. Anyway (this is me) adding that level of protection by default on all browsers looks a nice thing to have.
  • Ads (Score:3, Funny)

    by 1s44c (552956) on Friday January 29, 2010 @06:58AM (#30947622)

    If Chrome can't block ads it's not ready for the internet. It doesn't matter what else it does and doesn't do, blocking stupid flashing graphics is the main function of web browsers these days.

    • I have Adblock and a ton of other extensions working just fine in Chrome. Just use the testing / developer streams which have plugin support.
    • Re: (Score:2, Informative)

      by Ranzear (1082021)
      You're easily a month behind on this. https://chrome.google.com/extensions [slashdot.org]
      • Re:Ads (Score:5, Informative)

        by mister_playboy (1474163) on Friday January 29, 2010 @08:29AM (#30948006)

        For users familiar with the ad-blocking in Firefox or Opera, Chrome's ad-blocking extensions are terrible in comparison. They don't render the ad, but they still waste bandwidth downloading it, negating half of their value.

        Chromium doesn't include a provision for real element blocking, so this issue would have to be dealt with in the browser itself, not just in the extensions.

        • Re: (Score:2, Insightful)

          by W3bbo (727049)
          Some 'adblocker detection' services may flag your client if they see you've downloaded the page, but not the associated ad content, so they know your browser isn't displaying the ad, but if the client does download it they have no way of knowing if it's being rendered or not, short of using a DOM-inspection script. With the exception of Flash video adverts, I've never had any bandwidth problems with banners, except for those off-site advert scripts that delay the page loading.
      • by yuhong (1378501)
        Yep, I remember this article on Slashdot about it:
        http://tech.slashdot.org/story/09/12/17/1436257/Google-Says-Ad-Blockers-Will-Save-Online-Ads [slashdot.org]
        Also, note that part of why Larry and Sergey chose to use text ads for Google is that they found banner and pop-up ads annoying.
    • by Goaway (82658)

      Well, then, I guess that means Chrome is ready for the internet, huh.

    • by JThundley (631154)

      Here's how I block flash: Never install it in the first place.

      It's foolproof and works on all sites!

  • ...when Google goes ahead, tracks your every move, and sells it to the same crooks anyway?

    (Not trolling here. As far as I heard, Google does track everything. And as far as I know, Google does sell that information to advertisers as its main business. Finally, as far as I know, those advertisers include all those spamming crooks and their friends.)

    • Re: (Score:3, Insightful)

      by StripedCow (776465)

      And as far as I know, Google does sell that information to advertisers as its main business

      Not so sure about that... in their privacy statement, they say that they inform advertisers only about the number of times their ads were clicked (that is, in total, thus no information about individual clicks is released).

    • by couchslug (175151)

      "...when Google goes ahead, tracks your every move, "

      https://addons.mozilla.org/en-US/firefox/addon/3173 [mozilla.org]

    • by Anonymous Coward on Friday January 29, 2010 @09:59AM (#30948726)
      Add .google-analytics. to your AdblockPlus rules. Then install the Better Privacy extension. Finally, remove all existing cookies from Google and make sure that in future the permissions are set to 'Block'. Done, Google is not tracking you anymore.

      (I work at Google, hence posting as AC.)

    • I'm glad no one else is tracking me and that Bing doesn't use the same tactics. If you don't like being tracked then you should attack everyone rather than just the guy on top who will just end up being replaced by someone doing the same exact thing.
  • Can anyone tell me whether it finally installs in 'program files', on Windows XP? I haven't been able to find a way with the previous versions, and this is my only hurdle to installing it on my work PC due to the anti-virus rules.

  • I stopped using Chrome. It comes from a supplier that sees privacy as a problem, and I don't feel I have enough control over what it does with the information it gains from my surfing - that's also why I don't use Google DNS. I also have no idea how to switch the "referrer" information off (in FF that's quite easy).

    So, personally I don't give a damn what Chrome (or any other Google app) does. I prefer FF, even when I switch to OSX later this year (yes, I'm switching control freaks :-))..

  • Improving security is great, but they really need to keep working on usability as well! I just installed Chrome for the first time yesterday and have been playing around with it. It seems pretty speedy but the UI is a bit weird.

    The lack of a title bar seems kind of weird. I don't know what they were going for with that, but it's the only window on my entire machine and it stands out, and not in a good way. At one point i tried adding a new tab while waiting for visual studio to start a debug session, and
  • By this time next year we will be on Chrome Version 17!

The IQ of the group is the lowest IQ of a member of the group divided by the number of people in the group.

Working...