Post-Spectre Threat Model Re-Think
chromium.googlesource.com
chromium.googlesource.com
I'm not sure, but I think they are giving up on the best strategy here. The holy grail is for untrusted code to be totally deterministic, so that it cannot exploit Spectre or any other side channel attack.
Browser Javascript, which is historically single-threaded and event driven, is much closer to this than native code ecosystems where there are decades of investment in shared memory multithreading (which is very hard to make deterministic!) I don't think it would be impossible to make a JS engine where any given Javascript event handler and all the synchronous APIs it can call are deterministic, so that all interaction with the nondeterministic outside world is through events (and the "outgoing" side of these interactions would be delayed until the event handler stops running). Then I think you could make it so that the runtime of JS isn't measurable, or at least is only extremely coarsely measurable, via these events.
This is an intriguing idea: "a JS engine where any given Javascript event handler and all the synchronous APIs it can call are deterministic, so that all interaction with the nondeterministic outside world is through events".
It seems like that would be a significant re-think/re-organizing at a fundamental architectural level, that it would almost be a new language. Maybe Web Assembly could achieve this?
var c = 0
function deterministic_not_pure() {
return c++
}
As far as I know everything in Javascript-the-language has this property! [2] (Equally, so does WebAssembly). And most of the browser's APIs do as well, though the sheer size of that surface means that any attempt to fix the rare cracks will still be daunting. The vast majority of information that browser JS gets is either through events (i.e. function arguments) and I think most of the rest could be safely forced to be deterministic during the execution of a JS function.
It's still obviously possible for these events to leak timing information about the execution of JS, but I think that can be fought. For example, you could delay the delivery of every event by the number of nanoseconds that JS has executed on the page so far, though of course that naive approach will gradually degrade in performance. But I think for example doing that until you have 10ms of delay and then resetting would probably make timing attacks totally impractical.
All of this needs way more thought, and I'm not at all suggesting that it's easy. But browser JS is closer to an actually-securable-against-side-channels state than almost any other widely deployed platform, and I think it's sad for the people that control the platform (which is, let's face it, basically the Chrome team) to throw it away because they love performance.now() and SharedArrayBuffer.
[2] Well, ECMAScript probably doesn't specify a random number generator, for example. But it could.
Yes, I'm starting to see the difference between pure and deterministic. It seems like the latter is a description of a particular type of predictable/repeatable "program flow".
I found a related Wikipedia topic [1], "What makes algorithms non-deterministic?" Quote:
- If it uses external state other than the input, such as user input, a global variable, a hardware timer value, a random value, or stored disk data.
- If it operates in a way that is timing-sensitive, for example if it has multiple processors writing to the same data at the same time. In this case, the precise order in which each processor writes its data will affect the result.
- If a hardware error causes its state to change in an unexpected way.
Although real programs are rarely purely deterministic, it is easier for humans as well as other programs to reason about programs that are. For this reason, most programming languages and especially functional programming languages make an effort to prevent the above events from happening except under controlled conditions.
The prevalence of multi-core processors has resulted in a surge of interest in determinism in parallel programming.
---
The above includes a number of topics you raised, about events and timing information, and the possibility of making a language deterministic with some exceptions "under controlled conditions".
This part feels relevant too: "easier for humans as well as other programs to reason about".
[1] https://en.wikipedia.org/wiki/Deterministic_algorithm#What_m...?
Great that they're thinking about this, but I can't help but think many users will happily just copy-paste their CC details into random sites protected with a password of "password".
There's obviously strength in depth for security, and I applaud the developers for caring so much when users will attempt to subvert all security measures.
To be honest, we’re pretty much incentivised to by the fraud insurance structure. Any fraud is automatically covered through chargebacks. Eventually it’s the merchants that end up paying for this, big time, so they have the incentive to fix it. But since they are so far removed from the actual CC handling, usually (through PSPs, and the place a CC is stolen from is very far from the merchant who eventually is abused by it), there is very little they can actually do.
I don’t care two pence about where my CC ends up, to be honest. Beyond perhaps the very minimum I need to, to avoid being held liable for the chargebacks through neglect. Which is essentially never.
It’s not healthy for the overall system, but I pay for the privilege (through indirect fees), so I might as well use the comfort :/ tragedy of the commons.
CC fraud incentives are a tricky beast.