Reimagining the Browser: Introducing Cloudflare Browser Isolation Beta
blog.cloudflare.com
blog.cloudflare.com
This seemed like a pretty remarkable statistic to open with (where are the Office macros? If I download a shady exe or vbs with the browser and then run it, is the browser the "culprit"?), so I googled it and found that a previous Cloudflare post [1] cites this Gartner report [2] for that statistic. Unfortunately, there is no methodology to arrive at that number: it's merely listed as an assumption.
[1] https://blog.cloudflare.com/cloudflare-and-remote-browser-is...
[2] https://airlock.cdn.prismic.io/airlock/e0eca969-989e-44ad-b3...
• 2020: Websites are too complex. The security implications are too high. Let's run all of that code remotely, and send only draw commands to the user.
• 2025: Hey, developers, want your website to be faster and more efficient? Here's an API for performing certain operations directly on the user's machine. Don't worry, we've implemented everything in a limited and security-conscious way. Pinky promise the standard won't grow out of control over time.
• 2040: Neo-websites are too complex. Let's run all of that code remotely...
I'm not sure if I actually believe this will happen. But, consider how we got here: websites originally relied on server-side rendering, and gradually shifted to client-side rendering over time. Now, Cloudflare is offering a way to force all of that code back on to a server...
As a security product (if you trust Cloudflare), browser isolation sounds super tempting on-paper. As they mention in the blogspot, an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser. DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2].
So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly.
I have also been following MightyApp.com that is trying to do something similar but for consumers and with focus on productivity. It is interesting to see how this would play out. If there's a huge market for this, Google is sure to pounce on it too, and then things will get real interesting... as if AMP, WebComponents [2] and Privacy Sandbox [3] weren't already enough.
[0] https://news.ycombinator.com/item?id=19774768
[1] https://aws.amazon.com/hpc/dcv/
[2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen...
Literally exactly what Opera Mini has done since circa 2005[0]. The main difference here is that Opera Mini progressed to the gp's "2025" scenario quite some time ago by adding limited support for events alongside OBML's rasterization commands.
[0] https://github.com/grawity/obml-parser/blob/master/obml.md
Credential phishing doesn’t care where your browser is running, as I frequently have to remind IT teams who think their web proxy logs can identify 100% of victims of a phishing attack (there are almost always a few people who clicked on their phone). RBI of this type is specifically to mitigate vulnerabilities in the browser engine, the type of 0-day where you just click on the wrong thing and get owned. While these are a real threat, they are nowhere near 70%, more like less than 1% (and see my other comment about how the 70% number is just made up).
> [2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen...
Domain generation algorithms are used for malware command and control, not in the browser/phishing stage of an attack. An actual reason DNS blacklists aren’t perfect for this purpose is that attackers host malware distribution and phishing pages on legitimate services like Google Docs and Sharepoint.
Oh, to be clear, my post wasn't intended as a criticism of Cloudflare! Yes, Browser Isolation looks like it could be a great product.
If I sounded frustrated—which also wasn't intended—my frustration was with the industry more generally, for moving between technologies too quickly without learning from the past.
Can you explain why not? Your reference is talking about malware C&C trying to confuse reverse engineers, not phishing attacks happening in a browser.
Everything old is new again.
1984: X Window System. Architecture-independent system for remote graphical user interfaces and input device capabilities. X provides the basic framework, or primitives, for building such GUI environments: drawing and moving windows on the display and interacting with a mouse, keyboard or touchscreen.
Unlike most earlier display protocols, X is specifically designed to be used over network connections rather than on an integral or attached display device. X features network transparency, which means an X program running on a computer somewhere on a network (such as the Internet) can display its user interface on an X server running on some other computer on the network. The X server is typically the provider of graphics resources and keyboard/mouse events to X clients, meaning that the X server is usually running on the computer in front of a human user, while the X client applications run anywhere on the network and communicate with the user's computer to request the rendering of graphics content and receive events from input devices including keyboards and mice.
I've been working on a productivity oriented browser (early alpha here: https://cloudsynth.com -- sorry landing isn't complete yet). It's very obvious that those inner rendering frames can be handled by remote servers. We've managed to reduce a lot of chromes memory usage by sleeping/unmounting unused tabs transparently (where we can) and have seen a ton of performance improvement. Looking forward to swapping out the chromium rendering layer to a cloud one down the road!
The security implications are interesting too. Moving the 'sandbox' to the cloud for security purposes seems like the browsers definitely missed some of their goals.
No thanks.
I'm sure that there is some snarky comment about giving up freedom in exchange for security somewhere in there....
*many enough for it to be annoying
But at this point they have more control over the web than most governments. Or maybe all of them.
So I would assume that intelligence or military cyber agencies or whatever would feel compelled to somehow hook into Cloudflare. Similar to the way I assume they have done so with other mega tech companies.
On the bright side, somewhere in the swing from personal computing back to centralized computing models, I feel we hit a nice balance that made sense. Leverage the benefits and competitive marketing in personal computing when needed and aspects of centralized computing when it makes sense. Neither extreme is really all that great. Let's hope we can find that nice balance point again because where a bit too heavy on centralized computing IMHO.
There's also a lack of knowledge in present corporate management (at least in the US) generally speaking where the higher ups will reward apparent progress or activity without considering whether that activity is positive or negative long term. All that matters is that managers appear to be doing something, and when the sales people hand them a full narrative explaining how the next big thing will benefit their company, they accept it because they literally don't have to think or answer any of the hard questions to appear to be doing something useful/positive for their company.
It's sad, but I have hopes that as the old generation ages out of control of corporations that newer, smarter ones will form.
Hm, they'll be able to see every password, every url, every video frame... That's a lot of trust required to me. Cool tech though
I guess fearmongering is one way to try and convince people to use your product.
That sounds like a great solution to this problem, though I’m very curious about the details as to how that works, does anyone have resources to share?
> A key architectural feature of the Chromium browser is its use of the Skia graphics library. Skia is a widely-used cross-platform graphics engine for Android, Google Chrome, Chrome OS, Mozilla Firefox, Firefox OS, FitbitOS, Flutter, the Electron application framework and many other products. Like Chromium, the pervasiveness of Skia ensures ongoing broad hardware and platform support.
Because Cloudflare said they are using Skia so the first thing that comes to mind is, how do you hook into Skia in order to intercept graphics commands so that you can efficiently transfer them to the remote?
And then the next thing is, what if there are already graphics on the screen before the remote session starts? Do I have to record and transmit everything that happened an hour ago? Or how do I figure out which part needs to be transferred, aside from a clear screen which obviously resets it.
So that outline is exactly what I am seeing is being patented. They do mention they are using "hierarchies" to figure out what needs to be synced. But a hierarchy is one of the most fundamental categories of data structure so that really doesn't narrow it down.
So now if you're going to hook into a graphics library and use any kind of hierarchy and then transmit it to be updated somewhere else, you have to be worried about the details of this patent? Because what I am seeing is the basic logic that stems directly from the starting point of trying to transmit the graphics at that rendering level.
Like if I go fork Skia and hack into a renderer saving the commands into some queue to be compressed and streamed, and keep track of when a new window is opened or shown (a hierarchy), it seems like I will be putting myself at risk of this patent because it is so generic.
http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:6jr...
but it's also marked DEAD as of 2011, without any indicator as to why. There is a live trademark, created 2018, and it does indeed belong to Cloudflare:
http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:6jr...
I suppose Oracle doesn't really see itself as taking on the Sun mantle there, but I'm surprised they'd abandon a catchy slogan. Surely they'd find some reason to use it? How long would they have to ignore it before it got marked dead; is it really just two years? Why bother to file for it in the first place?
The user could load a locally saved (and audited) page in their browser which contains the JavaScript client that connects to the self-hosted version of this Cloudflare service. The client would require the user to enter a pre-shared secret which is used to encrypt and authenticate the data being sent back and forth with the server.
From a security perspective, I’m curious as to whether the attack model includes someone who exploits the browser and does not look to escape into the host OS, instead choosing to create UXSS and the like. Is there any work being done there as well?
We're working on a detailed technical blog post which will answer your questions in more detail.
PR from Cloudflare wanting you to use their network instead of others, I don't buy it. Respect them a little trying to knock google down a peg but still a power-hungry company.
That is it's purpose. It's not 'terrifying'.
How long until we start seeing the edge become small micro servers that live right beside metro network access points?
I assume it would have implications for tracking users, which would now impact not just Cloudflare customers but all web entities?
Thanks.
How can they monetize this?