Chrome Apes IE8, Adds Clickjacking, XSS Defenses 90
CWmike writes "Google has announced that it added several new security features to Chrome 4, including two security measures first popularized (some later shot down as having 'zero impact') by rival Microsoft's IE8 last year. The newest 'stable' build of Chrome includes five security additions that target Web developers who want to build more secure sites, said Adam Barth, a software engineer on the Chrome team. The two aped from IE include 'X-Frame-Options'" a security feature that helps sites defend against 'clickjacking' attacks, and cross-site scripting protection.'"In Google Chrome 4, we've added an experimental feature to help mitigate one form of XSS [cross-site scripting], reflective XSS,' Barth said. 'The XSS filter checks whether a script that's about to run on a Web page is also present in the request that fetched that Web page. If the script is present in the request, that's a strong indication that the Web server might have been tricked into reflecting the script.'"
Thanks (Score:1)
Re: (Score:2)
Re: (Score:2)
Would I have been so forgiving if it were IE that were late with their security additions?
I dunno... though I also dont know if this security addition works in IE8 either... ;-)
Re: (Score:3, Funny)
I read it as "Chrome Apes, IE8 Adds Clickjacking"...
Re: (Score:2)
I hope this new Chrome security works on the clickjacking on google's own SERPs.
Re: (Score:2)
Hahahaha! (the clickjacking happens when running searches while logged into a Google account).
Chrome Apes? Moronic Monkies? (Score:3, Funny)
Anyone else getting flashbacks from Planet of the Apes?
Is that the new code name for the next version of Chrome? Ubuntu Panhandling Panda, now featuring Chrome Apes! Download now! Steve Balmer your Monkey Boy days are numbered, so dance while you can, it's the year of the Google Desktop.
Re: (Score:1, Insightful)
Believe me, it's used frequently enough for any fluent speaker in conversations, let alone native speakers. It's an old one, besides, I found it in a dictionary from the 1950s.
Re:Chrome Apes? Moronic Monkies? (Score:4, Insightful)
I'm a native English speaker and it seems like a bizarre, stupid usage of the word to me. But then, Slashdot headline have always had trouble making sense.
Re: (Score:1)
The kids aped the apes, the apes aped the kids. The kids went ape.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
"to "ape" someone/thing is to imitate it"
Thanks yes. I always thought that to be common knowledge.
However, "ape" & "imitate" in google gives me a link to "www.thefreedictionary.com" where "to ape" is defined as "To mimic slavishly but often with an absurd result."
And that's exactly what I was trying to say earlier: it's a pretty negative way of describing behavior. But then to use it in the context of software? Ridiculous! Software doesn't ape,
Re: (Score:2)
Re: (Score:2)
# any of various primates with short tails or no tail at all
# imitate uncritically and in every aspect; "Her little brother apes her behavior"
# copycat: someone who copies the words or behavior of another
# caricature: represent in or produce a caricature of; "The drawing caricatured the President"
# anthropoid: person who resembles a nonhuman primate
You can thank me for the free English lesson later.
Re: (Score:2)
What is wrong with people? I made a joke, and they assume I don't understand the context? WTF?
Re: (Score:1)
Re: (Score:2)
I've had that thought a time or two, but never voiced it. Why don't we run a poll, and find out how many developers actually develop anything, and how many just tie scripts together, like the guy at the circus who makes dogs and horses out of balloons. It could get interesting!
Re: (Score:2)
just imagine how many developers will be baffled by this behavior
Imagining...
Done. Zero developers were baffled.
Imagining complete.
Re: (Score:2)
Hehe I am pretty sure this feature is disabled if you fetch the Google build of those scripts from the cloud...
(
Re: (Score:2)
It does not affect that in any way whatosever.
Re: (Score:2)
I assume (danger!) that they are only looking for XSS in the GET, POST and COOKIE input.
Cross-site scripting (Score:5, Interesting)
Recently I starting doing a bit of web development after being out of the loop for a while. I was working on a project and it was convenient to have the XHTML / JS running on my development machine while doing a few AJAX calls to my development server. After it failed at first I found I could add Access-Control-Allow-Origin: * to the HTTP header to allow cross-site access.
It made we wonder if you wanted to exploit cross-site vulnerabilities couldn't you setup a proxy in the middle that returned information from the original site but added that to the header? Anyway just got me wondering and maybe someone more knowledgeable could comment on it.
Re:Cross-site scripting (Score:5, Insightful)
At that point you're already a man in the middle and can send whatever you want to the browser, why on earth would you need to exploit XSS vulnerabilities?
Re: (Score:2)
Re: (Score:2)
Because you want to do something "useful" instead of just snooping?
Re: (Score:2)
No you are missing the point. The man in the middle can modify stuff going through so they just change the page itself rather than trying to use fancy XSS attacks.
Re:Cross-site scripting (Score:5, Informative)
If you are going to use Access-Control-Allow-Origin you should probably be aware that it is very new, and many browsers out there do not support it. Firefox added it in version 3.5.
Moderation abuse 101 (Score:2, Offtopic)
Re:Stay classy /. (Score:4, Insightful)
I hope the submitter realized that the only reason MS even bothered with any of this is thanks to them getting an ass pounding over the last few years for not giving a shit about security. Your welcome MS drones.
MS have never got the 'ass pounding' their security record has earned. If the security problems they cause cost them just 1% of what they cost their customers they would be bankrupt fairly quickly.
Software is weird, where else would you not be responsible for the faults in the products you sell?
Re: (Score:1, Insightful)
Because if you were, you probably wouldn't be able to purchase the software as it'd be seriously more expansive than it is today.
Re: (Score:3, Insightful)
Your house is seriously insecure, even if you have a steel door and have window panes are made of bullet-proof glass, you probably live in a stick frame building where a drill and a sawz-all can gain me access to the interior in an hour or two. Yet no one seems to get excited about the insecurity of our houses.
When our houses get robbed, we recognize that the wrongdoing is being done by the criminal. Yet when our computers are hacked, we place the wrongdoing on the provider of the software.
I have never real
Re: (Score:2)
Breaking into a house requires the criminal to be at the house physically and people understand that. Breaking into a computer can take place from virtually anywhere and that seems much more abstract. Since most people don't understand exactly what happened to allow the criminal access, they place the blame with someone who they assume does understand, the software manufacturer.
If a little kid gets hurt and you try to comfort them, they often get angry at you, at least briefly. Same basic idea.
Re: (Score:2)
Re: (Score:2, Interesting)
In large part because, as you point out, it's impossible to make a house physically secure (although security guards can hypothetically do a good job). Similarly, it's impossible to make a computer p
Re: (Score:1)
Locking your front door and window is merely a deterrent to your fairly normal, average civilized person. It's illusionary security, a social construct that says "hey, this is private, keep out". Same thing with passwords on accounts and firewalls.
Software is held to lofty standards because people don't understand it and blindly have faith in OS vendors, AV vendors etc to magically keep them safe. So when those software companies fail to protect them from threats they don't even really understand they get a
Chrome Apes IE8, Adds Clickjacking, XSS (Score:1, Offtopic)
Defenses
I like how Slashdot renders that headline.
Dumb article (Score:5, Insightful)
Oh my god Chrome is copying IE by supporting for the http header X-Frame-Options that Microsoft wants web developers to start using. Don't they know you're supposed to invent your own browser-specific variation of what your opponent implements?
I also like how they mention Chrome added 5 security features but they only cover the 2 that are already in IE.
It's nice that all of the browsers are adding security features but can we cover one of them without focusing on who did what first?
Re:Dumb article (Score:4, Insightful)
Google copies Microsoft. Google is showing no imagination. First their own OS, Browser and now security features that MS originally put in their browser.
I didn't knew that MS invented operating systems and browsers, and when you write your own that you're copying from MS.
Re: (Score:2)
I'm going to savor the day when there's an article about this awesome new feature in the Linux kernel that uses hardware encryption to verify the integrity of loaded kernel modules and prevent rootkits.
Re: (Score:2)
doesn't tivo already do this?
Protection on other browsers (Score:5, Informative)
Ads (Score:3, Funny)
If Chrome can't block ads it's not ready for the internet. It doesn't matter what else it does and doesn't do, blocking stupid flashing graphics is the main function of web browsers these days.
Re: (Score:2)
Chrome is open-source, right? Anybody else could add this to Chrome.
Adblock works fine in Chrome (Score:3, Informative)
Re: (Score:2, Informative)
Re:Ads (Score:5, Informative)
For users familiar with the ad-blocking in Firefox or Opera, Chrome's ad-blocking extensions are terrible in comparison. They don't render the ad, but they still waste bandwidth downloading it, negating half of their value.
Chromium doesn't include a provision for real element blocking, so this issue would have to be dealt with in the browser itself, not just in the extensions.
Re: (Score:2, Insightful)
Re: (Score:1)
Re: (Score:1)
http://tech.slashdot.org/story/09/12/17/1436257/Google-Says-Ad-Blockers-Will-Save-Online-Ads [slashdot.org]
Also, note that part of why Larry and Sergey chose to use text ads for Google is that they found banner and pop-up ads annoying.
Re: (Score:2)
Well, then, I guess that means Chrome is ready for the internet, huh.
Re: (Score:2)
Here's how I block flash: Never install it in the first place.
It's foolproof and works on all sites!
What's the need for all this security stuff... (Score:3, Insightful)
...when Google goes ahead, tracks your every move, and sells it to the same crooks anyway?
(Not trolling here. As far as I heard, Google does track everything. And as far as I know, Google does sell that information to advertisers as its main business. Finally, as far as I know, those advertisers include all those spamming crooks and their friends.)
Re: (Score:3, Insightful)
And as far as I know, Google does sell that information to advertisers as its main business
Not so sure about that... in their privacy statement, they say that they inform advertisers only about the number of times their ads were clicked (that is, in total, thus no information about individual clicks is released).
Re: (Score:2)
"...when Google goes ahead, tracks your every move, "
https://addons.mozilla.org/en-US/firefox/addon/3173 [mozilla.org]
Re:What's the need for all this security stuff... (Score:4, Informative)
(I work at Google, hence posting as AC.)
Mod parent up please, very informative! (Score:2)
Mod parent up please, very informative!
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
It's not like they are showing tweets with the comments...
Re: (Score:3, Funny)
It's not like they are showing tweets with the comments...
Please don't give them any ideas!
Re: (Score:1)
You think that my problem is clicking the icons ? These are adblocked. You think if you wanted to share interesting things in other networks you couldn't greasemonkey them yourself ? Of course not.
It's that they facilitate people who wish to share "interesting things" on gossip networks that bugs me.
Does it install in 'program files', on Windows? (Score:2)
Can anyone tell me whether it finally installs in 'program files', on Windows XP? I haven't been able to find a way with the previous versions, and this is my only hurdle to installing it on my work PC due to the anti-virus rules.
No thanks, no more Chrome for me. (Score:2)
I stopped using Chrome. It comes from a supplier that sees privacy as a problem, and I don't feel I have enough control over what it does with the information it gains from my surfing - that's also why I don't use Google DNS. I also have no idea how to switch the "referrer" information off (in FF that's quite easy).
So, personally I don't give a damn what Chrome (or any other Google app) does. I prefer FF, even when I switch to OSX later this year (yes, I'm switching control freaks :-))..
That's good, but work on usability too please (Score:2)
The lack of a title bar seems kind of weird. I don't know what they were going for with that, but it's the only window on my entire machine and it stands out, and not in a good way. At one point i tried adding a new tab while waiting for visual studio to start a debug session, and
Re: (Score:2)
I agree with you that they can't fix the aesthetics to please everyone. I'm hoping that changes like that will be something that's easy to implement in extensions later.
The part i'm more concerned about is the usability issues i talked about further down, particularly in regard to tabs. Like
Chrome 4? (Score:1)