News for hackers. Stuff that matters.

A comment on Userdir URLs like https://example.org/~username/ are dangerous. Parent comment

Re:Userdir URLs like https://example.org/~username/ are dang... by hn_throwaway_99 on Tuesday April 07, 2020 @11:31PM (#22809784)
> The modern web stack is a security house of cards, as demonstrated.

Perhaps, but I feel like major recent changes are fixing most of these vulnerabilities:

1. Content Security Policy locks down most of the vulnerabilities that result from something on a page being able to contact something from a different origin. Of course, it's not set by default and these days requires a lot of trial and error to figure out the "right" way to set it, but it solves a lot of issues.

2. On the cookie front, the recent changes to the default SameSite behavior also pretty much end CSRF bugs.

[ Parent | on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang... by objectified on Wednesday April 08, 2020 @06:04AM (#22811567)
1. Like you already hinted at, it is really difficult to get right, and I hardly experience any larger website (with multiple teams working on it) that implement it effectively. So while it's great in theory, I'm not sure if it's accessible enough (and therefore effective enough) for most of the world.

2. I'm assuming you're talking about Chrome's SameSite value; it's worth to note that this has been rolled back a short while ago because of compatibility issues in larger government organizations having to be accessible especially now with COVID-19. More info here: https://9to5google.com/2020/04/03/chrome-rolls-back-cookie/

[ Parent | on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang... by hn_throwaway_99 on Wednesday April 08, 2020 @02:32PM (#22815603)
1. It's not really hard to get right, it just takes a lot of trial and error. I.e. you essentially start with the default-src as 'self', and then create exceptions to other resources as you need them. You use the report-uri/report-to endpoints to get reports if either (a) you've neglected to open up a resource you need, or (b) you DO have a vulnerability that someone is trying to take advantage of. While this may sound like a bit of a pain, e.g. if you have multiple teams working on a website that all need to access their set of 3rd party endpoints, this pain is required for good security: it forces you to be explicit about the 3rd party endpoints you allow, instead of the browser just allowing any endpoint for things like script tags, imgs, etc. which is the default now.

2. Note what Chrome is rolling back is the SameSite default change. SameSite has existed for quite some time now, in all browsers, it's just that the default is currently 'None' in Chrome but is changing to 'Lax'. So you can still take advantage of this now, it's just Chrome is delaying changing the default so that it doesn't break sites who aren't prepared for the default change.

So my point is the tools currently available really tighten up the sandbox guarantees of the browser, and make it no more difficult than necessary to build a secure site.

[ Parent | on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang... by pdimitar on Wednesday April 08, 2020 @01:26AM (#22810310)
Would you provide links elaborating your both points? I haven't kept myself up to date with the web's security and I'm curious how those two problems were solved.
[ Parent | on HN ]