Hacker News Reader

Comment by bgirard | Hacker News Reader

Sadly I think long term mitigating these side-channel attacks is not viable. Although stop-gap patches can buy us more time to get a good solution in place.

It's impossible for something to behave in the same perfect way all the time with all the performance optimizations, fast paths, and branching. As soon as something is in your process or you can make requests to it, small internal differences will leak information via side channels.

View on HN

Right. That's why you should set the SameSite attribute on session cookies.

Sure, but cookies are only a small part of the problem. It's not enough.

reading of cross origin images isn't an attack vector unless credentials were used to request it.

Otherwise its no different then doing curl on the attacker's machine.

You're a bit too quick to jump to that conclusion so firmly.

There are other cases. Does you company have internal tools exposed via the intranet? If you happen to know the URI scheme, from say an ex-employee, you're able to exfiltrate information if you get a current employee on VPN to open your page. This becomes a tool in a layered attack. Sure it's careless to have such anonymous endpoint on your intranet. But there's a reason why anonymous images can't be plainly read back.

I'd say it's bad design to have everything important in the open just because it's behind a firewall; it's got a huge blast radius when something goes wrong.

Securing your services regardless of where they are in the network should be go the go to

I'd say accessing an internal ip counts as credentials, but i wouldn't be shocked if chrome disagreed.

Reply on news.ycombinator.com