Are you over 18 and want to see adult content?
More Annotations
![A complete backup of https://2ch.hk/ma/](https://www.archivebay.com/archive6/images/bc9b5f9c-a1d2-4882-90e4-b51569354a34.png)
A complete backup of https://2ch.hk/ma/
Are you over 18 and want to see adult content?
![A complete backup of https://chinaq.tv/cn191217/90.html](https://www.archivebay.com/archive6/images/1edd7d26-186b-42b5-ad11-c45c284a43a7.png)
A complete backup of https://chinaq.tv/cn191217/90.html
Are you over 18 and want to see adult content?
![A complete backup of https://javcl.com/page/3/](https://www.archivebay.com/archive6/images/4afc00eb-d3e3-449c-989f-d934b8702874.png)
A complete backup of https://javcl.com/page/3/
Are you over 18 and want to see adult content?
![A complete backup of https://www.mutaz.net/free-programs/download/?1616](https://www.archivebay.com/archive6/images/4a5b921e-8fc5-4d80-9889-e5890a345bb5.png)
A complete backup of https://www.mutaz.net/free-programs/download/?1616
Are you over 18 and want to see adult content?
![A complete backup of https://www.himemix.com/2020/12/no947_emiri05/](https://www.archivebay.com/archive6/images/be7ebecb-fa6c-4c45-b791-c003d8505a9b.png)
A complete backup of https://www.himemix.com/2020/12/no947_emiri05/
Are you over 18 and want to see adult content?
![A complete backup of https://morganthornton.blogspot.com/](https://www.archivebay.com/archive6/images/7fda1246-6d66-49d3-bf68-51564ff0b9d9.png)
A complete backup of https://morganthornton.blogspot.com/
Are you over 18 and want to see adult content?
![A complete backup of http://livenewspapertv.com/india/telugu/apherald-com/](https://www.archivebay.com/archive6/images/4676d2ca-4ee4-44d4-8d6e-dc10c1aeadcc.png)
A complete backup of http://livenewspapertv.com/india/telugu/apherald-com/
Are you over 18 and want to see adult content?
![A complete backup of https://sattamatka.software/](https://www.archivebay.com/archive6/images/58c6351d-5ce1-405a-abbf-3fa22547e099.png)
A complete backup of https://sattamatka.software/
Are you over 18 and want to see adult content?
Favourite Annotations
![A complete backup of https://ticketmaster.com](https://www.archivebay.com/archive6/images/c0ccf13b-9e46-4fa0-8b29-f3d03ca5daff.png)
A complete backup of https://ticketmaster.com
Are you over 18 and want to see adult content?
![A complete backup of https://asian-nation.org](https://www.archivebay.com/archive6/images/c2ae8734-4d85-4f7d-b6d4-9d783b3c4858.png)
A complete backup of https://asian-nation.org
Are you over 18 and want to see adult content?
![A complete backup of https://studyabroad.co.jp](https://www.archivebay.com/archive6/images/b6b0b43e-0d40-4126-94e1-f8b6fe97b2ed.png)
A complete backup of https://studyabroad.co.jp
Are you over 18 and want to see adult content?
![A complete backup of https://thejennyevolution.com](https://www.archivebay.com/archive6/images/a8b5fe50-50f1-4162-bd63-658d3d7e4918.png)
A complete backup of https://thejennyevolution.com
Are you over 18 and want to see adult content?
![A complete backup of https://iheartvegetables.com](https://www.archivebay.com/archive6/images/d046a344-22c0-49f3-9994-4e00b7477e1d.png)
A complete backup of https://iheartvegetables.com
Are you over 18 and want to see adult content?
![A complete backup of https://bottleworld.de](https://www.archivebay.com/archive6/images/7dab78df-f14e-4ef5-a84d-24b024d89b0b.png)
A complete backup of https://bottleworld.de
Are you over 18 and want to see adult content?
![A complete backup of https://windrose.aero](https://www.archivebay.com/archive6/images/1abda9b1-6eda-42e2-ad2c-2837774793e7.png)
A complete backup of https://windrose.aero
Are you over 18 and want to see adult content?
![A complete backup of https://eindiabusiness.com](https://www.archivebay.com/archive6/images/f338ef19-7b6a-45ad-bb25-4015a7930728.png)
A complete backup of https://eindiabusiness.com
Are you over 18 and want to see adult content?
![A complete backup of https://keycurriculum.com](https://www.archivebay.com/archive6/images/17d87354-29d9-4412-9873-5ac1beed78c8.png)
A complete backup of https://keycurriculum.com
Are you over 18 and want to see adult content?
![A complete backup of https://8891.com.tw](https://www.archivebay.com/archive6/images/2f514a89-7309-475c-b530-16909759a0ac.png)
A complete backup of https://8891.com.tw
Are you over 18 and want to see adult content?
![A complete backup of https://gportal.hu](https://www.archivebay.com/archive6/images/0cc42c5d-5d62-4b19-8775-98d32e081e60.png)
A complete backup of https://gportal.hu
Are you over 18 and want to see adult content?
![A complete backup of https://lavistarelatiegeschenken.nl](https://www.archivebay.com/archive6/images/abb7a2d2-0742-4f73-b21e-4ff1e95cb0ed.png)
A complete backup of https://lavistarelatiegeschenken.nl
Are you over 18 and want to see adult content?
Text
security-conscious
RESTRICTIONS ON FILE URLS For security reasons, Edge 76+ and Chrome impose a number of restrictions on file:// URLs, including forbidding navigation to file:// URLs from non-file:// URLs. If a browser user clicks on a file:// link on an https-delivered webpage, nothing visibly happens. If you open the the Developer Tools console, you'll see a note: “Not allowed to load local resource: FONT SMOOTHING IN EDGE Update, June 2021: See the Microsoft Edge blog post.Text rendering quality is an amazingly complicated topic, with hardware, settings, fonts, differing rendering engine philosophies, and user preferences all playing key roles. In some cases, however, almost everyone can agree that one rendering is superior to another. Consider, for instance, the text of this Gizmodo article DOWNLOADS AND THE MARK-OF-THE-WEB Background Windows uses a simple technique to keep track of which binary files were downloaded from the Internet (or a network share). Each downloaded file is is tagged with a hidden NTFS Alternate Data Stream file named Zone.Identifier. You can check for the presence of this “Mark of the Web” (MotW) using dir /r or programmatically,and
DISABLING TLS/1.0 AND TLS/1.1 IN THE NEW EDGE BROWSER This policy will remain available until the removal of the TLS/1.0 and TLS/1.1 protocols from Chromium in May 2021. Stated another way, the new Edge will stop supporting TLS/1.0+1.1 (regardless of policy) in May 2021. For IE11 and Edge Legacy, the policy in question is the (dubiously-named) “ Turn off encryption support ” found inside LIVIN’ ON THE EDGE: DUDE WHERE’S MY FIX?!? The simplest (and generally reliable) way to check is to just look at the Chrome token in the browser’s user agent string by visiting edge://version or using my handy Show Chrome Version browser extension. As you can see in both places, Edge 77.0.220.0 Canary is based on Chromium 77.0. 3843, a bit behind the 77.0. 3852 versioncontaining the
CORS AND VARY
Yesterday, I started looking a site compatibility bug where a page's layout is intermittently busted. Popping open the F12 Tools on the failing page, we see that a stylesheet is getting blocked because it lacks a CORS Access-Control-Allow-Origin response header: We see that the client demands the header because the LINK element that referencesit
TEXT/PLAIN – ERICLAW TALKS ABOUT THE WEB AND SOFTWARE IN Browsers tend to support four methods for authentication: the same four used for plain HTTP authentication: Basic, Digest, NTLM, and Negotiate (NTLM+Kerberos). The NTLM and Negotiate schemes are generally much preferred, as they can be configured to authenticate silently without showing a prompt to AW, SNAP! WHAT IF EVERY TAB CRASHES? For a small number of users of Chromium-based browsers (including Chrome and the new Microsoft Edge) on Windows 10, after updating to 78.0.3875.0, every new tab crashes immediately when the browser starts. Impacted users can open as many new tabs as they like, but each will instantly crash: As of Chrome 81.0.3992, the page will show ABOUT – TEXT/PLAIN Hi, I'm Eric Lawrence (@ericlaw), and you're reading my personal blog. Views expressed on this blog are my own; I'm not a spokesperson for any organization or entity. I've been working on the web in one way or another for two decades now, including over a decade at Microsoft. I created Fiddler and a variety DOWNLOAD BLOCKING BY FILE TYPE I've previously spoken about the magic of the File Type Policies component -- a mechanism that allows files to be classified by their level of "dangerousness", such that harmless files (e.g. .txt files) can be downloaded freely, whilst potentially-dangerous files (e.g. .dll files) are subjected to a higher degree of vetting and a moresecurity-conscious
RESTRICTIONS ON FILE URLS For security reasons, Edge 76+ and Chrome impose a number of restrictions on file:// URLs, including forbidding navigation to file:// URLs from non-file:// URLs. If a browser user clicks on a file:// link on an https-delivered webpage, nothing visibly happens. If you open the the Developer Tools console, you'll see a note: “Not allowed to load local resource: FONT SMOOTHING IN EDGE Update, June 2021: See the Microsoft Edge blog post.Text rendering quality is an amazingly complicated topic, with hardware, settings, fonts, differing rendering engine philosophies, and user preferences all playing key roles. In some cases, however, almost everyone can agree that one rendering is superior to another. Consider, for instance, the text of this Gizmodo article DOWNLOADS AND THE MARK-OF-THE-WEB Background Windows uses a simple technique to keep track of which binary files were downloaded from the Internet (or a network share). Each downloaded file is is tagged with a hidden NTFS Alternate Data Stream file named Zone.Identifier. You can check for the presence of this “Mark of the Web” (MotW) using dir /r or programmatically,and
DISABLING TLS/1.0 AND TLS/1.1 IN THE NEW EDGE BROWSER This policy will remain available until the removal of the TLS/1.0 and TLS/1.1 protocols from Chromium in May 2021. Stated another way, the new Edge will stop supporting TLS/1.0+1.1 (regardless of policy) in May 2021. For IE11 and Edge Legacy, the policy in question is the (dubiously-named) “ Turn off encryption support ” found inside LIVIN’ ON THE EDGE: DUDE WHERE’S MY FIX?!? The simplest (and generally reliable) way to check is to just look at the Chrome token in the browser’s user agent string by visiting edge://version or using my handy Show Chrome Version browser extension. As you can see in both places, Edge 77.0.220.0 Canary is based on Chromium 77.0. 3843, a bit behind the 77.0. 3852 versioncontaining the
CORS AND VARY
Yesterday, I started looking a site compatibility bug where a page's layout is intermittently busted. Popping open the F12 Tools on the failing page, we see that a stylesheet is getting blocked because it lacks a CORS Access-Control-Allow-Origin response header: We see that the client demands the header because the LINK element that referencesit
TEXT/PLAIN – ERICLAW TALKS ABOUT THE WEB AND SOFTWARE IN I’ve previously spoken about the magic of the File Type Policies component — a mechanism that allows files to be classified by their level of “dangerousness”, such that harmless files (e.g. .txt files) can be downloaded freely, whilst potentially-dangerous files (e.g. .dll files) are subjected to a higher degree of vetting and a more security-conscious user-experience. CLIENT CERTIFICATE AUTHENTICATION While most HTTPS sites only authenticate the server (using a certificate sent by the website), HTTPS also supports a mutual authentication mode, whereby the client supplies a certificate that authenticates the visiting user’s identity. Such a certificate might be stored on a SmartCard, or used as a part of an OS identity featurelike Windows
TEXT/PLAIN – PAGE 2 – ERICLAW TALKS ABOUT THE WEB AND If you need to debug a scenario involving drag/drop or copy/paste, you can use ClipSpy (binary only) or NirSoft InsideClipboard.. Bisecting. Bisecting is the process of making a repeated set of observations to determine the build in which a problem appeared (or disappeared).From there, you can easily assign bugs to the right owners for rapid fixes. TEXT/PLAIN – PAGE 6 – ERICLAW TALKS ABOUT THE WEB AND Referrer Policy allows a website to control what information is sent in Referer headers and exposed to the document.referrer property. As noted in the spec, the policy can be specified in several ways:. Via the Referrer-Policy HTTP response header.; Via a meta element with a name of referrer.; Via a referrerpolicy content attribute on an a, area, img, iframe, or link element. TEXT/PLAIN – PAGE 4 – ERICLAW TALKS ABOUT THE WEB AND Previously, I’ve described how to capture a network traffic log from Microsoft Edge, Google Chrome, and applications based on Chromium or Electron.. In this post, I aim to catalog some guidance for looking at these logs to help find the root cause of captured problems and TEXT/PLAIN – PAGE 18 – ERICLAW TALKS ABOUT THE WEB AND The Microsoft Edge (nee Internet Explorer) team held one of their “#AskMSEdge chats” on Twitter yesterday. After watching the stream, @MarkXA neatly summarized the chat: The folks over on WindowsCentral built out a larger summary of the tidbits of news that did get answered on the chat, some of which were just pointers to their Status and UserVoice sites. TEXT/PLAIN – PAGE 20 – ERICLAW TALKS ABOUT THE WEB AND Adobe recently announced that “Save for Web” in Photoshop is a “legacy feature” which won’t be improved. I decided to have a look at Adobe Photoshop CC (2015.0.0 Release 20150529.r88 x64) to see the impact of its many different “save” commands on the resultingfile size.
TEXT/PLAIN – PAGE 19 – ERICLAW TALKS ABOUT THE WEB AND RunAsUser. Back in the Windows Vista timeframe, the existing RunAs verb for ShellExecute was changed.Instead of prompting the user to run the target as a different user (e.g. the experience you get when you Shift-Right-Click on an app) it instead would treatMOTW – TEXT/PLAIN
Background Windows uses a simple technique to keep track of which binary files were downloaded from the Internet (or a network share). Each downloaded file is is tagged with a hidden NTFS Alternate Data Stream file named Zone.Identifier. TEXT/PLAIN – PAGE 12 – ERICLAW TALKS ABOUT THE WEB AND I’ve previously talked about using PNGDistill to optimize batches of images, but in today’s quick post, I’d like to show how you can use the tool to check whether images in your software binaries are well optimized.. For instance, consider Chrome. Chrome uses a lot of PNGs, all mashed together a single resources.pak file.Skip to content
TEXT/PLAIN
ericlaw talks about the web and software in generalLEAKY ABSTRACTIONS
In the late 1990s, the Windows Shell and Internet Explorer teams introduced a lot of brilliant and intricate designs that allowed intricate extension of the shell and the browser to handle scenarios beyond what those built by Microsoft itself. For instance, Internet Explorer supported the notion of pluggable protocols (“_What if some protocol, say, FTPS becomes as important as HTTP?”_) and the Windows Shell offered an extremely flexible set of abstract browsing of namespaces, enabling third parties to build browsable “folders” not backed by the file system– everything from WebDAV (“_your HTTP-server is a folder_“) to CAB Folders (“_your CAB archive is a folder_“). As a PM on the clipart team in 2004, I built a .NET-based application to browse clipart from the Office web services, and I sketched out an initial design for a Windows Shell extension that would make it look like Microsoft’s enormous web-based clipart archive were installed in a local folder on your system. Perhaps the most popular (or infamous) example of a shell namespace extension is the Compressed Folders extension, which handles the exploration of ZIP files. First introduced in the Windows 98 Plus Packand
later included with Windows Me+ directly, Compressed Folders allows billions of Windows users to interact with ZIP files without downloading third-party software. Perhaps surprisingly, the feature was itself was acquired from two third-parties — Microsoft acquired the Explorer integration from Dave Plummer’s “side project” , while a company called InnerMedia claims credit for the “DynaZIP” engine underneath. Unfortunately, the code hasn’t really been updated in a while. A long while. The timestamp in the module claims it was last updated on Valentine’s Day 1998, and while I suspect there may’ve been a fix here or there since then (and one feature, extract-only Unicode filename support), it’s no secret that the code is, as Raymond Chen says: “stuck at the turn of thecentury
.”
That means that it doesn’t support “modern” features like AES encryption, and its performance (runtime, compression ratio) is known to be dramatically inferior to modern 3rd-party implementations. So, why hasn’t it been updated? Well, “_if it aint broke, don’t fix it_” accounts for part of the thinking– the ZIP Folders implementation has survived in Windows for 23 years without the howling of customers becoming unbearable, so there’s some evidence that users are happy enough. Unfortunately, there are degenerate cases where the ZIP Folders support really _is _broken. I ran across one of those yesterday. I had seen
an interesting Twitter thread about hex editors that offer annotation(useful for
exploring file formats) and decided to try a few out (I decided I like _ReHex _ best). But in the process, I downloaded the portable version of ImHexand tried to
move it to my Tools folder. I did so by double-clicking the 11.5mb ZIP to open it. I then hit CTRL+A to select all of the files within, then crucially (_spoiler alert_) CTRL+X to cut the files to my clipboard. I then created a new subfolder in my C:\Tools folder and hit CTRL+V to paste. And here’s where everything went off the rails– Windows spent well over a minute showing “_Calculating…_” with no visible progress beyond the creation of a single subfolder with a single 5k file within: Huh? I knew that the ZIP engine beneath ZIP Folders wasn’t well-optimized, but I’d never seen anything _this _bad before. After waiting a few more minutes, another file extracted, this one 6.5 mb: This is bananas. I opened Task Manager, but nothing seemed to be using up much of my 12 thread CPU, my 64gb of memory, or my NVMe SSD. Finally, I opened up SysInternals’ Process Monitorto
try to see what was going on, and the root cause of the problem wasquickly seen.
After some small reads from the end of the file (where the ZIP file keeps its index), the entire 11 million byte file was being read from disk A SINGLE BYTE AT A TIME: Looking more closely, I realized that the reads were _almost _all a single byte, but every now and then, after a specific 1 byte read, a 15 byte read was issued: What’s at those _interesting _offsets (330, 337)? The byte 0x50, akathe letter P.
Having written some trivial ZIP-recovery code in the past, I know what’s special about the character P in ZIP files– it’s the first byte of the ZIP format’s block markers , each of which start with 0x50 0x4B. So what’s plainly happening here is that the code is reading the file from start to finish looking for a particular block, 16 bytes in size. Each time it hits a P, it looks at the next 15 bytes to see if they match the desired signature, and if not, it continues scanning byte-by-byte, looking for the next P. Is there something special about this particular ZIP file? Yes.The ZIP Format
consists of a series of file records, followed by a list (“Central Directory”) of those file records. Each file record has its own “local file header” which contains information about the file, including its size, compressed size, and CRC-32; the same data is repeated in the Central Directory. However, the ZIP format allows the local file headers to omit this data and instead write it as a “trailer” after the compressed data, a capability that is useful when _streaming _compression– you cannot know the final compressed size until you’ve actually finished compressing the data. Most ZIP files probably don’t make use of this option, but my example download does. (The developer reports that this ZIP file was created by the GitHub CI.) You can see the CRC and sizes are 0‘d in the header and instead appear immediately following the signature 0x08074b50 (Data Descriptor),
just before the next file’s local header: The 0x08 bit in the General Purpose flag indicates this option; users of 7-Zip can find it mentioned as Descriptor in the entry’s Characteristics column: Based on the read size (1+15 bytes), I assume the code is groveling for the Data Descriptor blocks. _Why _it does that (vs. just reading the same data from the Central Directory) I do not know. Making matters worse, this “read the file, byte by byte” crawl through the file doesn’t just happen once– it happens at least once for _every file _extracted. Making matters worse, this data is being read with ReadFile rather than fread().
Eventually, after about 85 million single byte reads, Process Monitorhangs:
After restarting and configuring Process Monitor with Symbols,
we can examine the one-byte reads and get a hint of what’s going on: The GetSomeBytes function is getting hammered with calls passing a single byte buffer, in a tight loop inside the readzipfile function. But look down the stack and the root cause of the mess becomes clear– this is happening because after each file is “moved” from the ZIP to the target folder, the ZIP file must be updated to delete the file that was “moved.” This deletion process is _inherently _not fast (because it results in shuffling all of the subsequent bytes of the file and updating the index), and as implemented in the readzipfile function (with its one-byte read buffer) is atrociouslyslow.
Back up in my repro steps, note that I hit CTRL+X to “Cut” the files, resulting in a Move operation. Had I instead hit CTRL+C to “Copy” the files, resulting in a Copy operation, the ZIP folder would not have performed a delete operation as each file was extracted. The time required to unpack the ZIP file drops FROM OVER THIRTY MINUTES TO FOUR SECONDS. For perspective, 7-Zip unpacks the file in under a quarter of a second, although it cheats a little.
And here’s where the abstraction leaks—
from a user’s point-of-view, copying files out of a ZIP file (then deleting the ZIP) vs. moving the files from a ZIP file seems like it shouldn’t be very different. Unfortunately, the abstraction fails to fully paper over the reality that deleting from certain ZIP files is an extremely slow operation, while deleting a file from a disk is usually trivial. As a consequence, the Compressed Folder abstraction works well for tiny ZIPs, but fails for the larger ZIP files that are becoming increasingly common. While it’s relatively easy to think of ways to dramatically improve the performance of this scenario, precedent suggests that the code in Windows is unlikely to be improved anytime soon. Perhaps for its 25thAnniversary?
– Eric
Posted byericlaw
2021-06-022021-06-03Posted
inperf , tech
Tags:debugging
, performance
, Windows
, zip
1 Comment on Leaky Abstractions OFFLINE NETLOG VIEWING A while back, I explained how you can use Telerik Fiddler or the Catapult NetLog Viewer to analyze a network logcaptured
from Microsoft Edge, Google Chrome, or another Chromium or Electron-based application. While Fiddler is a native app that runs locally, the Catapult NetLog Viewer is a JavaScript application that runs in your browser. Because NetLogs can contain sensitive data, some users have worried about the privacy of the viewer– what if someday it started leaking sensitive data from logs, either unintentionally or maliciously? Fortunately, the NetLog Viewer is a self-contained single page application that doesn’t need a network connection to run. You can use it entirely offline, either from a Virtual Machine with no network connection, or from a browser instance configured to override allnetwork requests.
Your first step is to get an copy of the viewer as a file. You can do that by right-clicking this link and choosing “Save Link As”. Save the HTML file somewhere locally, e.g. C:\temp\NetLogView.html on Windows. If you want to run it from a disconnected VM, simply copy the file into such a VM and you’re good to go. If, however, you want the convenience of running the viewer from your Internet-connected PC without worrying about leaks, you can run it from a browser instance that won’t make network connections. After saving the file, open it in a new browser window thusly: msedge.exe --user-data-dir=C:\temp\profile --inprivate --host-rules="MAP * 0.0.0.0" --app=C:\temp\NetLogView.html The command line arguments bear some explanation. In reverse order: * The app argument instructs Edge to open the supplied file with a minimal browser UI, as if it were a native app. * The host-rules argument tells the browser instance to direct all network requests to an IP address of 0.0.0.0. On Windows, such requests instantly fail . On Mac/Linux, the null IP points back at your own PC. * The inprivate argument directs the browser to discard all storage after the app exits (since it’s not needed). _For Chrome, use --incognito instead._ * The user-data-dir instructs the browser to use a temporary browser profile (which prevents the app’s window from being merged into an existing browser process, such that the host-rules argument would’vebeen ignored.)
While none of this is strictly _necessary_ (the NetLog Viewer doesn’t leak data), it’s always nice to be able to discard attack surface wherever possible.-Eric
Posted byericlaw
2021-05-25
Posted
inprivacy , security, web
Tags:debugging
, netlog
Leave a comment on OfflineNetLog Viewing
DOWNLOAD BLOCKING BY FILE TYPE I’ve previously spoken about the magic of the File Type Policiescomponent
— a mechanism that allows files to be classified by their level of “dangerousness”, such that harmless files (e.g. .txt files) can be downloaded freely, whilst potentially-dangerous files (e.g. .dll files) are subjected to a higher degree of vetting and a more security-conscious user-experience. FILE TYPE DANGER LEVEL Microsoft Edge inherits its file type policies from the upstream Chromium browser; you can view the current contents of the list here,
and documentation of its format here.
Within the list, you’ll see that each type has a danger_level,
which is one of three values: DANGEROUS, NOT_DANGEROUS, or ALLOW_ON_USER_GESTURE. The first two are simple: NOT_DANGEROUS means _Safe to download and open, even if the download was accidental. No additional warnings are necessary._ DANGEROUS means _Always warn the user that this file may harm their computer. Let users continue or discard the file. If returns a SAFE verdict, still warn the user before saving the file._ The third setting, ALLOW_ON_USER_GESTURE is more subtle. Such files are _potentially dangerous, but likely harmless if the user is familiar with download site and if the download was intentional._ Microsoft Edge will allow such downloads to proceed automatically if two conditions are met: * There is a user gesture associated with the network request that initiated the download (e.g. the user clicked a link to the download). * There is a recorded prior visit to the _referring origin _prior than the most recent midnight (i.e. yesterday or earlier). This implies that the user has a history of visiting the site. The download will also proceed automatically if the user explicitly initiated a download by using the SAVE LINK AS context menu command, entered directly into the browser’s address bar the download’s URL, or if Microsoft Defender SmartScreen indicates that the file is known safe. UPDATE: Starting in version 91, Microsoft Edge will join Google Chrome in interrupting downloads that lack the required gesture. USER EXPERIENCE FOR DOWNLOADS LACKING GESTURES Within Google Chrome, a download lacking a required gesture shows explicit buttons to allow the user to decide whether to proceed with the download or abandon it: In contrast, Microsoft Edge states that the download “was blocked”, although the same options, named Keep and Delete are available from the … menu on the download item. If you visit edge://downloads, you’ll see the same options:ENTERPRISE CONTROLS
While users are unlikely to encounter download interruptions for sites they use every day, they might encounter them for legitimate downloads on sites that they use rarely. To help streamline the user-experience for Enterprises, a Group Policy is available.Enterprises can use
ExemptDomainFileTypePairsFromFileTypeDownloadWarnings to specify the filetypes that are allowed to download from specific sites without interruption. If the SmartScreenForTrustedDownloadsEnabled (or equivalent policy for Chrome) is set to 0 (disabled), _and _the file download’s URL is Trusted (on Windows, in the Local Machine, Intranet, or Trusted zone) _then_ the download will proceed without interruption (even without a gesture), regardless of danger_level. (Aside: _This seems a bit strange, but feels more logical if you pretend that the file type warnings are a part of SmartScreen)._ FILE TYPES REQUIRING A GESTURE The latest file types policies are published in the Chromium source code. As of May 2021, file types with a danger_level of ALLOW_ON_USER_GESTURE on at least one OSplatform include:
crx, pl, py, pyc, pyo, pyw, rb, efi, oxt, msi, msp, mst, ade, adp, mad, maf, mag, mam, maq, mar, mas, mat, mav, maw, mda, mdb, mde, mdt, mdw, mdz, accdb, accde, accdr, accda, ocx, ops, paf, pcd, pif, plg, prf, prg, pst, cpi, partial, xrm-ms, rels, svg, xml, xsl, xsd, ps1, ps1xml, ps2, ps2xml, psc1, psc2, js, jse, vb, vbe, vbs, vbscript, ws, wsc, wsf, wsh, msh, msh1, msh2, mshxml, msh1xml, msh2xml, ad, app, application, appref-ms, asp, asx, bas, bat, chi, chm, cmd, com, cpl, crt, cer, der, eml, exe, fon, fxp, hlp, htt, inf, ins, inx, isu, isp, job, lnk, mau, mht, mhtml, mmc, msc, msg, reg, rgs, scr, sct, search-ms, settingcontent-ms, shb, shs, slk, u3p, vdx, vsx, vtx, vsdx, vssx, vstx, vsdm, vssm, vstm, vsd, vsmacros, vss, vst, vsw, xnk, cdr, dart, dc42, diskcopy42, dmg, dmgpart, dvdr, dylib, img, imgpart, ndif, service, smi, sparsebundle, sparseimage, toast, udif, action, definition, wflow, caction, as, cpgz, command, mpkg, pax, workflow, xip, mobileconfig, configprofile, internetconnect, networkconnect, pkg, deb, pet, pup, rpm, slp, out, run, bash, csh, ksh, sh, shar, tcsh, desktop, dex, apk OTHER FIELDS IN THE FILE TYPE POLICIES * You’ll also note that some file types have an auto_open_hint which controls whether the user may configure that type of file to open automatically when the download completes. * File type settings sometimes vary depending on the client OS platform (an .exe is not dangerous on a Mac, while an .applescript is harmless on Windows). The platform attribute of an entry specifies on which OS the danger_level applies. * The max_file_size_to_analyze field controls how big of a file (.zip, .rar, etc) the browser will be willing to unpack to scan it fordangerous content.
Posted byericlaw
2021-05-192021-05-21Posted
inbrowsers , web
Tags:Chromium
, download
, Edge
, security
, updates
Leave a comment on Download Blocking by File Type PER-SITE PERMISSIONS IN EDGE Last year, I wrote about how the new Microsoft Edge browser mostly ignores Security Zones (except in very rare circumstances) to configure security and permissions decisions. Instead, in Chromium per-site permissions are controlled by settings and policies expressed using a simple syntax with limited wildcarding support. SETTINGS PAGE’S SITE PERMISSIONS AND GROUP POLICY Internet Explorer offered around 88 URLAction permissions, but the majority (62) of these settings have no equivalent; for instance, there are a dozen that control various features of ActiveX controls, a technology that does not exist in the new Edge. Unfortunately, there’s no document mapping the old URLActions to the new equivalents (if any) available within the new Edge.When users open
chrome://settings/content/siteDetails?site=https://example.com, they’ll find a long list of configuration switches and lists for various permissions. Users rarely use the Settings Page directly, instead making choices using various widgets and toggles in the PAGE INFO dropdown (which appears when you click the lock) or via various prompts or buttons at the right-edge of the address bar/omnibox. Enterprises can use GROUP POLICY to provision site lists for individual policies that control the browser’s behavior. To find these policies, simply open the Edge Group Policy documentation and search for FORURLS to find the policies that allow and block behavior based on the loaded site’s URL. I recently wrote a post about Chromium’s URL Filter syntax,
which doesn’t always work like one might expect. Most of the relevant settings are listed within the Group Policy for ContentSettings
.
There are also a number of policies whose names contain DEFAULT that control the default behavior for a given setting. Here’s a list of SITE SETTINGS with information about their policiesand behavior:
* LOCATION
No SiteList policy, but it can be controlled entirely via defaultgeolocationsetting* CAMERA
No SiteList policy, but it can be controlled entirely via videocaptureallowedurls* Microphone
No SiteList policy, but it can be controlled entirely via audiocaptureallowed * MOTION OR LIGHT SENSORS* NOTIFICATIONS
DefaultNotificationsSetting * JAVASCRIPT _If you’re especially security-conscious, you could disable JavaScript on all sites except those you manually trust. _Managed by the defaultJavaScriptSetting,
JavascriptAllowedforUrls and JavaScriptBlockedforUrlspolicies.
* IMAGES
defaultimagessetting,
imagesallowedforurls * POPUPS AND REDIRECTS _“This site may initiate a popup without a signal (such as a user gesture)
that such a popup is expected.”_ Controlled by the popupsallowedforurls and defaultpopupssettingpolicies.
* ADS _You may be surprised to learn that Chrome and Edge have a built-in ad-blocker. It is only capable of blocking ads on a small list of sites which have been flagged by the vendor for “abusive ad use” (site shows intrusive or misleading ads). This setting allows you to exempt ads on sites that have been so flagged. (Sadly) you cannot use this setting to block ads on sites that are not on theabusive ad list._
* BACKGROUND SYNC _Web API that allows ServiceWorker applications to perform sync operations inthe background._
* AUTOMATIC DOWNLOADS _This is a misleading setting name. Basically, it amounts to “This site may initiate a file download without a signal (such as a user gesture)
that such a download is expected.”_ Presently, there’s no Policy to control this; a site should be architected to avoid triggering this permission. (Note: Presently, there are bugs for downloads from cross-origin frames and also Edge’sIEMode).
* HANDLERS – _Prompting and configuration for the HTML5 RegisterProtocolHandler API_. Managed by RegisterProtocolHandlerspolicy.
* MIDI DEVICES _WebMIDI is a standard for integrating with musical instruments._ * ZOOM LEVELS _The browser stores any non-default Zoom level the user has set when visiting the page._ * USB DEVICES Managed by DefaultWebUSBGuardSetting,
WebUsbAllowDevicesForUrls,
WebUsbAskForUrls
WebUsbBlockedForUrls * SERIAL PORTS DefaultSerialGuardSetting* FILE EDITING
* COOKIES Controlled by a bakery full of policies, defaultcookiessetting,
cookiesallowedforurls (with a surprising relationship to Auth),
cookiesblockedforurls,
cookiessessiononlyforurls,
blockthirdpartycookies.
* INSECURE CONTENT _By default, the browser will block “active mixed content” (e.g. JavaScript served via HTTP) when embedded on a HTTPS page._ The insecurecontentallowedforurls policy allows you to shoot yourself in the foot. * YOUR DEVICE USE _Allow sites to detect when the device has gone idle _ _or the screen has beenlocked/unlocked. _
As you can see, some of these settings are very obscure (WebSerial, WebMIDI) while others will almost never be changed away from theirdefaults (Images).
-Eric
Posted byericlaw
2021-03-292021-04-01Posted
inbrowsers
Tags:Chromium
, Edge
, enterprise
, security
, UX
Leave a comment on Per-Site Permissions in Edge SPECIFYING PER-SITE POLICY WITH CHROMIUM’S URL FILTER FORMAT Chromium-based browsers like Microsoft Edge make very limited useof
Windows Security Zones. Instead, most permissions and features that offer administrators per-site configuration via policy rely on lists of rules in the URL FILTER FORMAT. Filters are expressed in a syntax that is _similar _to other matching rules, but different enough to cause confusion. For instance, consider a URLBlocklist rule expressedas follows:
These filters don’t work as expected. The HTTPS rule should not have a trailing * in the path component (it won’t match anything), while the DATA: rule requires a trailing * to function. The syntax has a few other oddities as well: * A leading dot before the host means EXACTLY MATCH; the filter .example.com matches just https://example.com but not https://WWW.example.com * You may specify a path prefix (example.com/foo) but you must not include a wildcard * anywhere in the path * You may specify wildcards in a query (example.com?bar=*); you may omit the path to have the querystring checked on all pages, or include a path to only check the querystring on pages within the path. * A rule of blob:* doesn’t seem to match blob URLs, while a rule of data:* does seem to match all data URLs. Unfortunately, there’s not a great debugger for figuring out the proper syntax. You can use the chrome://policy page to see whether Chrome finds any glaring error in the policy: …but short of _testing _your policy there’s not a great way to verify it does what you hope. Q: THE PROBLEM OF _SPECIAL_-URLS There are a variety of _special _URLs (particularly BLOB and DATA) that do not directly express a hostname– instead, the URL exists within a _security context _that is not included in the URL itself. This can cause problems for Policies if the code implementing the policy does not check the URL of the _security context_ and looks only at the blob/data URL directly. A system administrator might set a policy for downloads from https://example.com/download, but if download page on that site uses a script-generated file download (e.g. a blob), the policy check might overlook the rule for example.com because it checks just the blob: URL. An example bug can be found here.
Q: CAN FILTERS MATCH ON A SITE’S IP? The Permissions system’s “Site Lists”feature
does not support specifying an IP-range for allow and block lists. Wildcards are not supported. It does support specification of _individual _IP LITERALS, but such rules are only respected if the user navigates to the site using said literal (e.g. http://127.0.0.1/ ). If a hostname is used (http://localhost ), the IP Literal rule will not be respected even though the resolved IP of the host matches the filter-listed IP. Q: CAN FILTERS MATCH _JUST _DOTLESS HOSTNAMES? Not today, no. You must individually list each desired hostname, e.g. (https://payroll, https://stock, https://who, etc). Chromium’s URL Filter Format is convenient if your intranet is structured under one private domain (e.g. *.intranet.example.com) but is much less convenient if your Intranet uses dotless hostnames (http://example) or many disjoint private domains. The ability to match only hostnames not containing dots would be convenient to accommodate the old IE behavior whereby Windows would map dotless hostnames to the Local Intranet Zone by default.
(_To my surprise, there’s been no significant demand for this capability in the first year of Edge’s existence, so perhaps corporate intranets are no longer using dotless hostnames very much?_)REFERENCES
* Edge Docs: Filter format for URL list-based policies * Chrome Docs: URL list filter formatPosted byericlaw
2021-03-292021-04-27Posted
inbrowsers , web
Tags:compatibility
, enterprise
, intranet
, security
Leave a comment on
Specifying Per-Site Policy with Chromium’s URL Filter Format WEB PROXY AUTHENTICATION Last year, I wrote about how the new Microsoft Edge’s adoption of the Chromium stack changed proxy determinationaway
from the Windows Service (WinHTTP Proxy Service) to _similar but not identical_ code in Chromium. This change mostly goes unnoticed, but it can have performance and functionality implications. In today’s post, I want to explore another side-effect of changing away from the Windows stack– the impact on Proxy Authentication.BACKGROUND
When the client is configured to route its traffic through an authenticating proxy server, the proxy responds to any request that does not contain a PROXY-AUTHORIZATION request header with a HTTP/407 response that demands credentials, specifying the desired authentication scheme using a PROXY-AUTHENTICATE header: The client is expected to resend the request with the requested credentials added in the Proxy-Authorization header. Browsers tend to support four methods for authentication: the same four used for plain HTTP authentication: Basic, Digest, NTLM, and Negotiate (NTLM+Kerberos). The NTLM and Negotiate schemes are generally much preferred, as they can be configured to authenticate _silently _without showing a prompt to the user. However, depending on configuration (e.g. not in the right zone, or when the user’s Windows Login Credentials are not the ones the proxy requires), the user might see a proxy-authentication prompt in the browser. BROWSER CREDENTIAL UX The prompt differs depending on the client; Google Chrome, and until recently Microsoft Edge, show an auth “bubble” anchored to the bottom of the browser address bar UI. In contrast, the latest versions of Edge and Internet Explorer show the battleship gray Windows Hellomodal dialog box:
While these experiences are all conceptually similar, they differ in very important ways. First, note that Internet Explorer’s option shows a “Remember my credentials” checkbox while Chrome/Edge do not. Proxy credentials saved by Internet Explorer will be reused _without prompting_, across browsing sessions and across other applications that use the WinHTTP Proxy Service. In contrast, in Chrome and older Edge, the proxy credentials prompt is integrated with the browser’s Password Manager. If the user accepts the followup prompt to save the proxy credentials, those credentials will autofill the dialog in future browser sessions. Notably, however, the proxy authentication is not automatic– the user must manually click the SIGN IN button once per browser session. Storing a credential in your Edge profile’s password manager only applies to that one browser profile– other profiles and apps do not have access to the credential. In Edge 88+, this password manager integration was lost in the switch to use the Windows Hello prompt for NTLM/Negotiate. A new policy (WindowsHelloForHTTPAuthEnabled)
added to Edge 90 changes Edge’s proxy credentials dialog back to theolder dialog.
OTHER APP CREDENTIAL UX Support for manually-authenticating proxies outside of browsers has always been terrible,
and many Win8 applications didn’t even bother to handle it. Sadly, that shortcoming remains in Windows 10, where you can’t even use the Windows Store when a proxy needs credentials that are not supplied automatically. An generic error page is shown: However, as mentioned earlier, around IE11 a change was made to push proxy authentication creds entered in Internet Explorer’s proxy authentication prompt into the Windows Credential Manager (CredMan): As seen in the Control Panel view (Persistence: Enterprise): Even if you untick the “Remember my credentials” box on the prompt, the entered creds are still remembered for the Windows session (Persistence: Login Session): As a consequence, users can “unbreak” various Windows scenarios by just using the browser to populate the Credential Manager with theproxy credentials.
We’ve lost that workaround in the new world, because Chromium’s password manager is not integrated with CredMan (for a number of sane1reasons).
SURFACE HUB
The Microsoft Surface Hub is a “whiteboard computing” device designed for corporate conference rooms and the like. By default, the Windows logon session on the device uses an account named ComputerName\SurfaceHub, and that account is very unlikely to be supported by an authenticating proxy. To support it, Windows’ Settings applet on Surface Hub has a customoption:
However, this option doesn’t presently do anything for Chromium’s network stack. When Edge gets a Proxy-Authorization: Negotiate challenge from the proxy, it will respond with the credentials for the SurfaceHub account rather than the machine credentials, and the login will likely fail. At present, we don’t have a great workaround for this: it’s probably possible to write a browser extension (catchingthe onAuthRequired
event and responding with non-default credentials) but this won’t pick up the Windows settings.OTHER BROKENNESS
* We recently fixed a bug in Edge Canary where the browser would crash on startup if the user was behind a manually-authenticated proxy server. A network request triggered very early in browser startup wasn’t prepared for an auth challenge. * If you have the Microsoft Office Chrome extension installed, it can (for reasons unknown)
automatically cancel the manual proxy authentication dialog before the user has a chance to submit credentials. In conclusion: Two decades in, support for proxy authentication remains a mess. The feature is required by the networks of some corporate titans (and thus support continues to limp along), but many corner cases remain broken. Consider carefully whether proxy authentication needs to be a part of your network strategy.-Eric
1 There are several reasons, but one obvious one is that Chromium uses a “profiles” system whereby one Windows logon account may have multiple browser profiles, each of which is independent and does not share data with the others. This precludes direct use of system-level features that do not offer such partitioning.Posted byericlaw
2021-02-122021-02-13Posted
inbrowsers , security, web
Tags:authentication
, enterprise
, proxy
Leave a comment on Web ProxyAuthentication
WINDOW.CLOSE() RESTRICTIONS Sometimes, Web Developers are surprised to find that the window.close() API doesn’t always close the browser window. When looking at the Developer Tools console, they’ll see a messagelike:
Scripts may close only the windows that were opened by them. WHY DO BROWSERS LIMIT CLOSE()? Before we dive into what factors govern what happens when close() is called, it’s important to understand why there’s a restriction atall.
While sometimes explained away as nebulous “_Security reasons!_“, the core reason is more aligned with simple USER-EXPERIENCE— users could lose important state in their browser window or “back/forward” stack (in IE, we called this the TRAVELLOG) if a tab or window went away unexpectedly. The user might’ve been using a tab to explore a set of search results, and if one of those results could blow away both itself and the backstack with the search results page, this would be pretty annoying. There’s a minor anti-abuse/security argument as well– if a browser tab could blow itself away freely, this might be useful as a part of scareware or other user-experience abuses. WHAT DOES THE STANDARD SAY? Here’s what the dom-window-close section of the HTML Standard has to say: > _A browsing context is script-closable if it is an auxiliary > browsing context that was _CREATED BY A SCRIPT_ (as opposed to by > _AN ACTION OF THE USER_), or if it is a top-level browsing context > whose session history contains only one Document.> _
This seems simple enough, although the parts I’ve bolded hide a lot of complexity and nuance. (Most obviously, _“what should we do if the script was run in response to an action of the user?_“) WHAT DO BROWSERS DO? Unfortunately for us, each browser has a different set of behaviors (explore with this test page ), partly because most were implemented before the standard was written.INTERNET EXPLORER
In Internet Explorer, a tab/window will be closed silently if it was created as a result of a JavaScript window.open() call. There’s no attempt to check whether the back/forward stack contains only one document: a tab with a large TravelLog will still close silently if it was opened by script. (IE also allows HTA documentsto close themselves
without restriction.) In all other circumstances, the tab/window will not silently close: instead, the user is presented with a one of two modal dialogs, depending on whether the page represents the only tab in the browserwindow:
CHROMIUM (MICROSOFT EDGE / GOOGLE CHROME / ETC)As of Chromium 88
,
window.close() succeeds if the new window/tab has an openerOR if
the back/forward stack contains fewer than two _entries_. As you can see, there are subtle differences here between what the _spec_ _requires_ and what the _browser implements_. First, notice that I said “has an opener” rather than “was created by a script.” Recall that the opener property allows a popup window to refer to the tab that created it. * If the user creates a new tab by clicking the frame button, hitting Ctrl+T, Shift+Clicking a link, or launching a URL from the Shell, the resulting new tab doesn’t have an opener set. * In contrast, if the tab is opened via open() or
hyperlink with a named target (not _blank), then
by default, the opener property is set. * Any hyperlink may include rel=opener or rel=noopener to specify whether the new tab has an opener set.* A open
()
JavaScript call can specify noopener in its windowFeatures string to set the new tab’s opener to null. As you can see from the above list, both normal link clicks and JavaScript open() invocations can result in tabs _with _or _without _the opener set. This can be very confusing: Shift+click on a link might result in a tab that cannot self-close, while Left-click on that same link results in a tab that can always close itself. Secondly, notice I said “entries” rather than “Documents.” In _most _cases, these are equivalent, but they’re not exactly the same. Consider the case where the new tab navigates to a HTML document with a Table of Contents at the top. The user clicks on a ToC link to #Section3 and the browser dutifully scrolls down to that section. The back/forward stack now contains TWO entries, both pointing to the same document. Chromium blocks window.close(), but it shouldn’t. This longstanding shortcoming was made more visible in Chromium 88, which now gives links targeting _blank the noopener behavior by default.crbug.com/1170131
tracks fixing this issue by counting the number of Documents in the back/forward stack, but it will be tricky to fix because presently the renderer process running JavaScript has access only to the _count _of entries in the back/forward stack, not theirURLs.
CHROMIUM: USER-EXPERIENCE When Chrome blocks close(), it emits a notice to the console: Scripts may close only the windows that were opened by them. …but there’s no notice to the user, who may be left confused if they clicked on a “Close” button or link inside the page. Recently filed crbug.com/1170034 suggests introducing a dialog box like Internet Explorer’s. _(As an aside, it also sets a new standard for bug filing by including comic-book style art showing unhappy users converting to happy users if the proposed feature is landed. :)_ CHROMIUM: EXOTIC BUG TRIVIA _This is a super-obscure corner case. However, I’ve seen it independently reported against both Chrome and Edge in the span of five years, and it makes me laugh._ If you set Chromium’s ON STARTUP option to “Continue where you left off”, navigate to a page that _tries_ to close itself , and then close the window, the browser will subsequently kill itself on every startup. It’s _hard _to get into this state, but it’s still _possible _inChrome/Edge 90.
Repro steps: Visit https://webdbg.com/test/opener/. Click the ‘_Page that tries to close itself_‘ link. Hit Ctrl+Shift+Delete and _Clear Browsing History_ (to clear the back/forward stack). Close the browser with the ‘X’ icon. Now, try to launch the browser from your start menu. Giggle wildly as your browser launches and then blows itselfaway.
SAFARI/WEBKIT
WebKit’s code
is similar to Chromium’s (unsurprising, considering their sharedlineage) except
it
does not equate navigations triggered with noopener with those created by browser UI. Thus, in Safari, the user may click between many different same-origin pages and close() is still permitted. If close() is blocked, Safari’s (well-hidden) JavaScript consoleshows:
Can't close the window since it was not opened by JavaScriptFIREFOX
Unlike Chromium, Firefox correctly implements the “only one Document” part of the spec. Firefox calls IsOnlyTopLevelDocumentInSHistory which calls IsEmptyOrHasEntriesForSingleTopLevelPage() which enumerates the history list to check. If there is more than one entry, whether all of the entries are for the same Document. If they are all for the same document, the close() succeeds. Firefox offers an about:config override setting named dom.allow_scripts_to_close_windows that bypasses the defaultrestrictions.
When Firefox blocks close(), it emits a notice to the console: Scripts may not close windows that were not opened by script. There’s an 18 year-old feature request for Firefoxto show a
confirmation dialog instead of failing silently.IN CONCLUSION
_umm…. browsers are wicked complicated?_-Eric
Posted byericlaw
2021-02-042021-02-05Posted
inbrowsers , web
Tags:browsers
, Chromium
, compat
, compatibility
, Firefox
Leave a comment on
window.close() Restrictions SANDBOXING VS. ELEVATED BROWSING (AS ADMINISTRATOR) The Web Browser is the most security-critical application on most users’ systems– it accepts untrusted input from servers anywhere in the world, parses that input using dozens to hundreds of parsers, and renders the result locally as fast as it can. For performance reasons, almost all code in almost all browsers is written in memory-unsafe languages. To mitigate this insanity, web browsers perform this chainsaw juggling act inside nested layers of sandboxing. When an attacker inevitably manages to find an exploit, the resulting damage might be contained by the sandbox. Chromium calls this “The Rule of 2”:
As a consequence, most real-world browser attacks now must include exploits for two vulnerabilities: the original RCE, and a SandboxEscape.
A web browser uses multiple mechanisms for sandboxing, from “Design sandboxing” (Same-Origin-Policy,
limited JavaScript capabilities) to Process Sandboxing (AppContainers, UAC Integrity Levels, Restricted Tokens, etc) to optional VM sandboxing (WDAG).
Process sandboxing arose in the mid-200Xs as a defense-in-depth against Design Sandboxing mistakes – any error in implementation meant that an attacker could achieve arbitrary code execution (RCE) and take over the victim user’s computer. Windows Vista introduced the notion of UAC Integrity Levels, whereby each system object (including processes) had an integrity level that limited the other objects it could read and write. Internet Explorer 7 built atop the UAC Integrity Levels system and introduced the notion of “Protected Mode” whereby Internet Zone content ran inside a tighter sandbox with decreased write-access to the system. Google Chrome and later versions of IE went much further, with AppContainers and broader process restrictions to make exploitation more challenging and reduce its impact. Tools like SysInternals’ Process Explorer allow inspecting some of the sandboxing limitations applied to browsers’ processes. For instance, you can see the Windows Job restrictions applied to this Edge Renderer Process: You’ll note that browsers typically use multiple processes with different sandboxing restrictions attached to each. For instance, in a default launch of Chrome, you’ll see that the main browser process launches at the default (“Medium”) Integrity Level, while the GPU process runs at Low Integrity, and the Renderer processes run at Untrusted Integrity (the lowest): Looking at Internet Explorer, you can see that its main process runs at Medium, an Intranet Zone tab process runs at Medium, and an Internet Zone tab process runs at Low: If you enable Enhanced Protected Mode, that Internet Zone tab process is further restricted to run in an AppContainer: RUN AS ADMINISTRATOR One interesting difference between Legacy IE and Microsoft Edge/Chrome is the behavior when you “Run As Administrator”: In the old IE, this resulted in the tab processes running unsandboxed at High IL: For reasons that are hopefully obvious, running web content outside of a sandbox at High IL is an extremely dangerous configuration. In contrast to IE behavior, in Edge/Chrome, the browser process, crash handler, and some utility processes run at High IL, but the sandboxed Renderers stay in Untrusted IL processes. While this is clearly a _safer _configuration that what Internet Explorer had, the transitive nature of UAC Elevation means that many executables launched by this browser are launched at High Integrity, including Native Messaging Hosts,
AppProtocol Handlers,
downloaded executables, etc.FUNCTIONAL BUGS
Beyond the increased security attack surface, there are some functional problems with running a Chromium-based browser at High IL. For instance, if you have AppLocker enabled, you may find that all of your sandboxed renderer processes crash (crbug.com/740132 ), or that link launches from non-admin processes are ignored (crbug.com/801539#c9).
As a result of problems like these, Microsoft Edge will attempt to SILENTLY DEELEVATE AND RELAUNCH itself when launched as an Administrator, running at Medium IL instead of High. If this feature is disabled (--do-not-de-elevate), Edge will show a warning to help users recognize the unexpected situation: GENERALLY SPEAKING, THERE’S NO LEGITIMATE REASON TO RUN YOUR BROWSER AT HIGH IL, AND YOU SHOULDN’T EVER DO IT._But…_
IMPACT ON WINDOWS INTEGRATED AUTHENTICATION Recently, I was disappointed to learn that there are some scenarios where running at HighIL is still necessary. These scenarios are based on Windows Integrated Authentication, whereby the web server uses _passthrough authentication _to pass the user’s _Elevated _Authentication Token through to some backend service that requires membership in the Administrators group. If the web server receives and passes along the admin user’s non-elevated token (because the browser was run at Medium), the backend services will refuse to undertake the privileged operation. The fact that such an application architecture ever worked is interesting but a bit bananas. I’d be much happier with a design whereby this Elevated token passing scenario didn’t have to happen in the browser— either configuration should happen in some non-browser application, or the Service Account could invoke some native UI to collect the admin’s elevated credentials during the specific configuration operation where such credentials are needed. From a layering POV, I’m sure this would be complicated, because the ability of a background service to pop stuff on the admin user’s desktop is intentionally limited. If you’re depending upon an architecture like this, please stop. _Pretty please!_ It’s fragile: it behaves differently based on the user’s default browser, behaves differently depending on what browser windows the user already has open (launch msedge.exe as Admin doesn’t result in an Elevated browser if Edge was already open), and exposes the user to a greater attack surface if they use the Elevated browser for anything else after finishing with your scenario. Stay safe (and de-elevated) out there!-Eric
Posted byericlaw
2021-01-072021-01-26Posted
inbrowsers , securityTags:administrator
, authentication
, browsers
, sandbox
, UAC
, Windows
1 Comment on Sandboxing vs. Elevated Browsing (As Administrator) OBJECTIVELY, THE BEST CAT On March 15, 2009 we put my cat Jill (Jillian, Jilly, Jilly Bean, Jillkin) to sleep at an emergency vet. We didn’t know for sure why her kidneys failed, but it was sudden and unexpected. At times Jill could be grumpy and stubborn, but she was usually friendly, curious, and she was always very loved. I lamented at the time that it was “_never going to be _time to feed the monster _again_,” and we would always miss her. I didn’t expect to have another pet for along time.
But then life intervened. A Friday night two weeks later, my fiancée and I were waiting for a movie to start at the Regal theater next to the Crossroads mall in Bellevue. We saw that the Petco store adjacent was hosting some cats for adoption. We had no plans to get a new pet, especially not so soon, but we took a look anyway. I liked the look of a big cat (“Yoda”) snoring lazily in his cage, but Jane preferred a tiny black cat with a shaved belly and a curious face. After looking for a few minutes, we left for our movie. In our seats, waiting for the previews to end, Jane remarked “_She’s black and white. We could call her Domino_.” and I spent the rest of subsequent movie impatiently waiting for it to end: the name was so perfect I couldn’t imagine living in a world where it wasn’t hers and she ours. Unfortunately, the pet store closed before our movie ended, but we were back bright and early the next day toadopt her.
A street kitten, under-weight, under-furred and under-age (she was allegedly a year old but plainly was only a few months) she took to her new home immediately; her fur grew in and she eventually stopped chasing her own tail. Domino was playful and alert, and always pushing boundaries. We let her out a few times, but she kept getting hurt, one time returning with teeth marks on both sides of her little ribs suggesting that a dog had gotten its jaws around her entire body. After that, she was confined to our new deck– as soon as she stepped off, we’d pick her up and put her back on it. She clued in and began keeping a single paw arched back to the bottom step of the deck, her other three triumphantly planted in the grass. It was soon a common sight, one so comical that it was ingrained in my memory to the point that I never bothered to take a picture. I’d’ve never believed if I hadn’tseen it.
Unlike many cats who are standoffish or aloof, Domino was empathic– if we ever cried or even sounded sad, she’d immediately appear and start rubbing up against us, a furry friend without advice, just love. We bought her a fancy bed, but she never wanted to sleep in it– she always snuggled up to us instead. When we moved from Seattle to Austin in 2012, we decided to drive rather than fly to make the trip easier on her– drugging her for a flight seemed cruel and unnecessary. A day into the trip, we realized what an error we’d made… she spent the first two days of the trip hiding in the back of the car, climbing up to the dashboard to peer out, then, terrified at America whizzing by at 75mph, jumping into the back or a lap to lay back down. This process repeated every few minutes until she’d fall asleep for short naps. By the third day, she was plainly miserable; when we finally rolled into our new driveway, the first order of business was to let her out to explore her new back yard. Her backyard explorations were rare after that– we’d seen coyotes and snakes in the neighborhood, and between those threats and the blazing Texas summers, she was happy enough as an indoor cat. An occasional foray into the backyard to nibble some grass or roll around on the patio seemed to keep herhappy.
We grew up together. In 2013, we nervously brought our first son home, worried about how Domino might react. She kept her distance. In fact, if anything, she seemed terrified, avoiding both his crib and her food bowl. Her odd behavior went on for a few days until I finally figured out what hadhappened.
Tied to newborn Noah’s car seat floated a congratulatory Mylar balloon, and having never seen one, Domino was terrified of it. I foolishly made the mistake of trying to carry her over to it to show her that it was nothing to be afraid of. She clawed her way out of my arms, over my shoulder, and down my back, peeing the whole way. Later that afternoon, Noah peed all over me as I changed his diaper, and I joked that it was “_pee on Dad day_.” After we got rid of the balloon, Domino was the perfect big sister, tolerating a toddler who would occasionally pull her tail or chase her around, never lifting a paw against him no matter how rough he wanted to play. Her patience continued with our second son, and it paid off– as they grew up, the boys were always happy to snuggle, pet her, and build increasingly elaborate cat forts out of whatever cardboard boxes they could get their hands on. She humored them and snuggled them every chance she got. But she snuggled with all of us, including sleepy mom and dad. When my wife asked me to move out a year ago, there wasn’t much debate — our cat was coming with me. Domino kept me company through the roughest pandemic year alone in a new home. Two or three other cats in my new neighborhood roamed free and Domino noisily defended her turf through the windows. As the weather cooled down, she started keeping me company on the porch, and then demanding to go out between dinner and bedtime. A month ago, she went out late and didn’t come back until first light, banging on my bedroom window and demandingbreakfast.
So I didn’t think too much about it as I acceded to her demands and let her out the back door at around 11pm the night of November 9th, 2020. “_Be good. Don’t get in trouble!_” I admonished as always. At 12:30am, I checked for her, but she wasn’t around, so I reluctantly went to bed. I woke up a few times in the night and checked for her, but she wasn’t around. When I woke up at 8am, I was officially worried. By the afternoon, I was papering the neighborhood with posters, updating the contact info for her microchip, and learning about all of the web resources for reuniting lost pets (some of which are pretty cool).
Going to bed alone that night with her still at large was hard. And it hasn’t gotten any easier over the last week, no matter how many posters I’ve put up, or web postings I’ve scoured.o
Sounds like a great cat, huh? Well, you haven’t heard the real storyyet.
Back when Noah was four, his right knee started swelling. We assumed it was bruising from a fall, but he didn’t complain about pain and the swelling didn’t go down in weeks. A series of doctors’ visits, scans, and a fully-anesthetized MRI led to a diagnosis of PVNS, a
non-cancerous tumor that nonetheless would require major surgery on both the front and back of Noah’s knee. The expert doctor at Dell Children’s Hospital assured us that it was as clear a case as he’d ever seen, and we needed to do the surgery soon to ensure that Noah’s leg would grow normally. I pushed for doing the operation right away, but Jane suggested we do it later in the fall so that Noah would be able to recover without the temptations of the swimming pool and other summer fun. Around this time we noticed Domino had developed a large growth (about the size of a large marble) in her neck, a recurrence of a problem (keratin buildup?) she’d had previously. We hoped she’d get better on her own again this time, as we had bigger worries now. Throughout August and September, Noah would watch cartoons on the couch, and Domino would lay her swollen chin on his swollen knee. When it came time to go back to the hospital for Noah’s operation, the doctor was gobsmacked– the mass was completely gone. He had no explanation– he’d never seen anything like it. The doctor asked us to do an MRI in an attempt to figure out what had happened, but after confirming that Noah wouldn’t need surgery and an MRI wouldn’t change anything for his diagnosis, we declined. We were overwhelmed with relief. Domino’s growth disappeared too. I’m not saying my cat cured my son (and vice-versa), but our best doctors don’t seem to be in a position to say that’s not whathappened either.
I miss my friend.
Posted byericlaw
2020-11-162020-11-17Posted
inlife Leave a comment on Objectively, the best cat SIMPLY MAKING SIMPLE FIXES SIMPLE FOR CHROMIUM Google recently introduced a cool web-based editing tool for Chromium source code, a very stripped down version of the Willy Wonka tooling Googlers get to use for non-Chromium projects. I’ve used this tool to submit twotrivial
change lists (CLs, aka PRs) to Chromium, but I was curious about whether this new feature would work for something not completely trivial, and while remaining simpler than the full Checklist for contributing to Chromium.
Let’s try it.
First, find an Available GoodFirstBug.
Say, this one
to
remove an expired flag. Let’s search for the flag.
Not too many hits:
Let’s click into the first hit to open it. Click EDIT CODE at thetop right:
A web-based code editoropens:
Remove the &kOverlayNewLayout line and the function that references it later in the file. Use the navigation panel on the left to open the .h file corresponding and remove the declaration of the feature. Open about_flags.cc and remove the lines referencing the flag: Note that this will create orphan variables for the flag_descriptions that we need to go delete too. Go delete those from the flag_descriptions.cc and flag_descriptions.h files. At this point, your Pending Changes pane contains all of the files with all of the hits that came up in the search. If we think we’re done, we can go hit the CREATE CHANGE button to actually create the change for review. However, _suspiciously_, we haven’t actually found anything that respects the Feature we removed. If we instead search for OverlayNewLayout we see an additional hit appears: Having worked on stuff like this before, I know that there’s some _magical _marshalling of feature values from C++ into Java-land (Android’s UI layer). So we need to go eliminate the use of the Java-side feature. Search for OVERLAY_NEW_LAYOUT.
Oof. There are 8 more files: 7 are Java and one is a similarly-named variable in a CC file. (It’s a variable in C++ code that set based on the feature’s state from the Java-side based on a resource ID._Sneaky sneaky_).
Worse, one of the early hits is this one: … So we also need to remove this function entirely and update all of its callers to not check it. Fortunately, only two more files have references, but clearing up some of those implies that we _might _have resources that will become unused: When we’re done pulling all the threads, the change has grown pretty big. Click CREATE CHANGE to put all of our changes together into achange list:
In the dialog that appears, enter a description of the changelist andclick CREATE:
After a minute or so, a notice will appear: Sadly, it’s not a hyperlink, but if you look down at the bottom of the editor, you’ll find a direct link to the Chromium Code Review site, where you can find the created change.
After the CL is prepared, you can add reviewers for a code review,
ask anyone with Try Permissions to run your change through the bots, and otherwise follow the process for contributing to Chromium.
If you need to modify a change after you’ve created a CL,
you can do so using the EDIT link on the Code Review Site. Push thebutton:
… then use the new commands down near the file list to modify (or add) files in the CL: A few observations from this process: 1. A lot of Chromium GoodFirstBug‘s are much more complicated than they appear. This one required a followup CLto
remove 400 more lines! 2. This new web-editing workflow is great for trivial fixes, but very limited. Most importantly, if you need to use any advanced tools (e.g. source formatting, manual code generators, presubmit checks, etc), you’ll need to download your CL from the code review site to use thetools on it.
3. Multi-file changes are challenging. It would be awesome to be able to just click “Edit Code” from the Chrome Source Viewer on multiple files and have them all open in the same “in-progress” change set, but it doesn’t seem to work like that (yet?). You must manually find all files after the first one in the editor’s sidebar. I’m excited to see how Chromium’s EDIT CODE feature evolves.-Eric
Posted byericlaw
2020-10-272021-05-20Posted
inbrowsers , dev
Tags:Chromium
, dev
Leave a comment on Simply Making Simple Fixes Simple for ChromiumPOSTS NAVIGATION
1 2 3
… 23
Older posts
SEARCH TEXT/PLAIN
Search for:
PAGES
* About
* IEInternals ArchiveRSS
RSS - Posts
BLOG STATS
* 1,439,255 hits
CATEGORIES
Categories Select Category bluebadge (11) books (2) browsers (119) design (10) dev (50) fiddler (18) life (4) perf (18) politics (1) privacy (19) reviews (1) security (85) storytelling (7) tech (15) Uncategorized (17) web (60) windmills (12)ERICLAW
Impatient optimist. Dad. Author/speaker. Created Fiddler & SlickRun. PM @ MSFT '01-'12, and '18-, presently working on Microsoft Edge. Mywords are my own.
PERSONAL LINKS
* Text/Plain Blog
* GitHub
View Full Profile → text/plain , A WordPress.com Website.
Write a Comment...
Email (Required) Name (Required) WebsiteLoading Comments...
Comment
×
* FollowFollowing
* text/plain
*
Already have a WordPress.com account? Log in now.*
* text/plain
* Customize
* FollowFollowing
* Sign up
* Log in
* Report this content * Manage subscriptions* Collapse this bar
Details
Copyright © 2024 ArchiveBay.com. All rights reserved. Terms of Use | Privacy Policy | DMCA | 2021 | Feedback | Advertising | RSS 2.0