zlacker

[parent] [thread] 10 comments
1. pmoria+(OP)[view] [source] 2022-06-22 12:29:16
"Security is another big one in that the WebKit process is running with privileges that Apple does not want to award to any other app process on the platform, much less a third-party one."

If they really cared about security then they could subject their browser to an independent security audit, and require the same audit be passed for any other browser that's allowed on their platform.

Why don't they do this?

replies(2): >>threes+e3 >>pilif+o6
2. threes+e3[view] [source] 2022-06-22 12:49:28
>>pmoria+(OP)
> Why don't they do this?

Because the idea that all you need to do to ensure software is secure is hire an expensive consultant is ridiculous.

Especially with a web browser which are highly complex pieces of software.

replies(1): >>pmoria+04
◧◩
3. pmoria+04[view] [source] [discussion] 2022-06-22 12:55:09
>>threes+e3
"the idea that all you need to do to ensure software is secure is hire an expensive consultant is ridiculous"

Taking Apple's word for their browser being secure and other browsers not is just as if not even more ridiculous.

What fair, independent way of determining browser security would you suggest be used instead of an audit?

replies(1): >>CHY872+TH
4. pilif+o6[view] [source] 2022-06-22 13:09:48
>>pmoria+(OP)
I don't think an audit will be able to even coming close to validate the security of a piece of software with the complexity of a browser.

As it stands now, WebKit and the processes hosting it (Safari, WKWebView) are probably the most complex piece of software running on our iOS devices and as we can see, they are full of security flaws.

But so are the engines of all other browser makers.

Audits is not what uncovers security flaws. Detailed research, fuzzing and effectively unlimited time to do both on the side of white-hat hackers and unlimited budget and criminal energy on the side of black-hats is what does.

Same is true for other engines of course.

But being restricted to a single engine shipped and updated as part of the OS with tailor-made support by the OS for sandboxing and JIT restrictions for this one engine does help to reduce attack surface.

Also, my initial concern isn't as much about third parties shipping their browsers (though, consider how many third party browsers exist and how many are well-maintained), but much more about apps embedding a vulnerable version of an engine and never updating it ("it works fine for us - no need to change a running system")

replies(2): >>pmoria+57 >>spanka+6e
◧◩
5. pmoria+57[view] [source] [discussion] 2022-06-22 13:14:41
>>pilif+o6
"Audits is not what uncovers security flaws. Detailed research, fuzzing and effectively unlimited time to do both on the side of white-hat hackers and unlimited budget and criminal energy on the side of black-hats is what does."

Audits aren't supposed to be an ultimate guarantee of security, but provide a minimum, independently judged hurdle that has to be passed to get on the platform.

If there's a better, independent way to judge what browsers are "secure enough" to be on the platform (ie. not just "Apple says no"), I'd love to hear about it.

replies(2): >>pilif+x7 >>spanka+oe
◧◩◪
6. pilif+x7[view] [source] [discussion] 2022-06-22 13:17:21
>>pmoria+57
Apple thinks (and I'm inclined to agree) that no browser engine is safe enough to be on the platform but as there has to be at least one by necessity, they might as well reduce the attack surface by restricting it to a single one that's tightly integrated with the OS security measures and which is updated together with other OS updates.
replies(1): >>pmoria+H9
◧◩◪◨
7. pmoria+H9[view] [source] [discussion] 2022-06-22 13:32:03
>>pilif+x7
Following that reasoning there should only be one app of each kind on the platform: an Apple app.

Minimize attack surface, minimize choice.

replies(1): >>pilif+Jt
◧◩
8. spanka+6e[view] [source] [discussion] 2022-06-22 13:58:22
>>pilif+o6
Having an engine monoculture doesn't actually reduce attack surface. People don't visit each web page with every browser they have installed on their device.

What it does is hold part of the system constant, so that attackers know ahead of time that iOS users will be running WebKit. Reducing variability makes attacks easier and increases the value of WebKit vulnerabilities.

◧◩◪
9. spanka+oe[view] [source] [discussion] 2022-06-22 13:59:54
>>pmoria+57
What do you think an audit is, and why do you think you can even approach a useful one on a codebase the size of WebKit? It's not realistic.
◧◩◪◨⬒
10. pilif+Jt[view] [source] [discussion] 2022-06-22 15:09:03
>>pmoria+H9
A calendar app provides a much smaller attack surface than a browser. It can also perform good enough without the need for JIT compilation.

As I said in my comment: I believe Safari and the underlying WebKit to be the most complex and most insecure part of iOS by multiple orders of magnitude.

Not adding more of equally complex and demanding pieces does provide a significant reduction of attack surface

◧◩◪
11. CHY872+TH[view] [source] [discussion] 2022-06-22 16:09:26
>>pmoria+04
This isn't a competition for 'most secure' necessarily. Rather, simply reducing the surface area for attack is positive from a security perspective. If there's some vulnerability in iOS that come from being able to make pages executable, if you only have Safari JIT-ing you have to find a bug in Safari, or the app store review process (and get the user to download your app). If iOS runs Chrome as well, you can find a bug in _either_ Safari _or_ Chrome.

While that's just Safari and Chrome, that's probably ok. But what happens when it's Safari, Chrome, Firefox, Opera, Brave, etc, etc?

For the security test, there are various ways that an org builds software with integrity, and it's the sort of thing that requires a huge amount of effort to get right. Standards like FedRAMP, SOC2, ISO9001, etc etc are the sorts of standardized things that exist (containing things like 'all code must be reviewed'). I think for a browser, if you were Apple and were looking to accept other browser partners, you'd likely do something like this; regular audits of quality, requirements that must be met to maintain access, pentests, basically a continuous process that's to be met by the supplier (similar to how hardware suppliers must meet many requirements).

[go to top]