Web browsers have become ever more important for our computers. Instead of the browser displaying static HTML pages, they now handle complex web applications, ranging from social networking to text editors to online banking, and everything in between. While some browsers have finally started treating the browser more like an operating system (Chrome and Internet Explorer 8), those are just baby steps. The real thing is coming with Microsoft's Gazelle, a research project which applies operating system concepts to the browser.
Post a Comment
Member since:
2006-01-03
Member since:2009-04-24
How is that a new thing?
I'd call this a BSOD. Wouldn't you agree? 
http://img219.imageshack.us/img219/144/bsod.png
Member since:2005-07-06
Member since:2009-04-24
Member since:
2006-03-20
not sure basing your security on domains is the right idea .. there is no real reason that abc.com is different from def.com ... its just a DNS domain name and that doesn't mean they are different or the same originator. this isn't that revolutionary.
its a bit like a Windows anti-virus application treating files differently depending on their drive letter (C:, D:, etc). in reality it doesn't mean anything. they could even be on the same drive!
they'd be better off sorting out buffer overflows and more bread and butter security weaknesses ...
Edited 2009-07-08 00:34 UTC
Member since:2006-01-02
That's not what people generally exploit on the web. It's far more common to see these Cross-Site Scripting attacks against the design of the web applications than against the browser code.
It's the same reason why people go after applications running on Windows much more than after the OS itself: it's a lot easier and likely just as lucrative.
Member since:2006-02-05
One very common and insidious (has happened with google and amazon, among others) attack is Cross Site Request Forgeries (or CSRF)
The idea is this: you go to your bank, and check the "keep me signed in" checkbox (which any bank worth their salt would NOT have, but this is an example). That site puts an authentication cookie in your browser. Next time you go to the site, it checks the cookie, and doesn't bother asking for username/password, but just forwards you a long to the next screen.
Now, I have a site (or use an XSS attack against a site you use), and I do an AJAX request that mimics a form submission to transfer money to my account. The site receives the request, checks for authentication, since it is the browser making the request it finds the cookie, and just lets it through.
These kinds of exploits are very difficult to avoid, the only thing you can really do is generate an authentication tolken on every page, and then checking for it on the next request from that session.
Member since:
2005-09-17
Member since:2006-02-05
Member since:2008-08-19
Very much so. Never mind "in the future" - the web is already well on the way to an application-like platform, and has been for several years. And if you look through recent Firefox release notes, you'll notice that a substantial proportion of the bugs fixed in the 3.0.x series were security bugs of this kind.
Member since:
2006-02-05