Hacker News Reader

Comment by _vvhw | Hacker News Reader

Another way of looking at this scoreboard is as an approximate inverse ranking of webmail client security and leak vectors, with Gmail stripping far more dangerous elements than most webmail clients.

This is actually a great tool to find vulnerabilities in various webmail clients such as ProtonMail and Hey, just compare the HTML or CSS features they do not yet filter compared to Gmail, then do a search for "[feature] + exploit" to see how a feature could be abused, and then submit a bounty report.

For example, there are alot of good reasons that you may not want your webmail rendering SVG images (mXSS, appcache poisoning) or allowing CSS variables or imports.

And I'm pretty sure the list supported by Gmail could also be narrowed down further. There are some fantastic bounties lurking in here, just waiting to be discovered.

View on HN

Curious, what's the risk with SVG, assuming a CSP is used for it that doesn't allow anything (including no scripts)?

SVG is a minefield so massive it's hard to give an exhaustive list of everything that could go wrong. Especially when these kinds of assets might be hosted on user content domains and where webmail clients might allow access to the SVG content with inline disposition but outside of an IMG tag (most browsers enable/disable various SVG features such as JS or an app cache manifest according to context). There are also a ton of weird rendering modes that can be triggered for SVG (or MathML) and these can be used to bypass XSS sanitizers by means of mXSS which exploits differences in browser renderings when roundtripping content.

And sites with strong CSPs are often especially vulnerable to scriptless attacks, perhaps because they feel more protected. For example, in 2019, there was a bug bounty disclosure to Fastmail about a way to intercept and proxy all email attachment downloads, completely client-side, and yet without involving any JavaScript, simply using HTML5 AppCache. This also affected a whole lot of other providers, but the Fastmail team patched this within 24 hours, a pretty amazing response, and the quickest by far.

Here's a fantastic paper from Mario Heiderich (of Cure53) from 2012 on various kinds of scriptless attacks: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.46...

I've said it before, I'll say it again: the web needed a vector answer to jpeg, but what we got was a vector answer to html+css with all their commensurate vulnerabilities and complexities.

The other major web vector format...

is PDF. Yeah, PDF has drawing commands. Most vector formats are based on command sequences, that map 1-1 with what you'd find in a drawing library like Cairo. EPS and PDF both work that way, which makes it even more of a typical vector format than SVG (which only does the command sequence thing with paths, AFAIK). Of course, it's not that well supported (the in-browser reader does who-knows-what to get it to render, I think it's converted to DOM elements), but it is the other major browser-supported vector format.

I’d love to know where FastMail ranks on here.

Fastmail's security is top notch. They're using Cure53's DOMPurify and their team understand these vectors really well, with strict filtering. Their pixel tracking blocking was better than Hey's when last I checked, and I reported three leaks to Hey that were not fixed for some time. Fastmail also run one of the best bounties I have ever participated in. I would even say significantly better than ProtonMail, having participated in both bug bounties.

Nice to hear that, I'm a Fastmail customer and the Android up is subpar on offline access (or unreliable connections, looks like it's basically hitting the network for everything. Knowing that at least security-wise it's a good product makes me happier.

What are the advantages of using FastMail's android app over a normal mail client? I'm thinking of moving to Fastmail from Gmail.

shrug dunno what other mail clients have but I've used Fastmail's email client for over a decade and never thought "wonder if someone else's is better".

Some more integration with other FastMail services (like calendar or "disk space" for files) mainly. Also normal MUAs on Android are usually ugly as hell, I still have to find one that I really like. But the online-only bug of FM client is really becoming an issue worth switching.

This makes me happy I chose it

Oh yeah.

Those nth-child* selectors Gmail strips out are a real security nightmare.

Reply on news.ycombinator.com