Comments on: Improving Google Chrome http://www.gnucitizen.org/blog/improving-google-chrome/ Information Security Think Tank Tue, 06 Jan 2009 04:06:47 +0000 http://wordpress.org/?v=2.7 hourly 1 By: radi http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123732 radi Tue, 16 Sep 2008 11:55:58 +0000 https://www.gnucitizen.org/?p=1250#comment-123732 "Let’s have another Chrome Mode which is called Encrypted Mode -> New encrypted window Ctrl + Shift + E. Once inside this window, HTTPS is forced on all requests. No exceptions!" Can you elaborate a bit more, please? Would this mean that use of HTTPS would be mandated by the browser as opposed to by the web app? “Let’s have another Chrome Mode which is called Encrypted Mode -> New encrypted window Ctrl + Shift + E. Once inside this window, HTTPS is forced on all requests. No exceptions!”

Can you elaborate a bit more, please? Would this mean that use of HTTPS would be mandated by the browser as opposed to by the web app?

]]> By: Hubert http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123694 Hubert Fri, 12 Sep 2008 12:37:38 +0000 https://www.gnucitizen.org/?p=1250#comment-123694 Reasonable idea but I doubt they would ever implement it since it will break many (most) websites. Reasonable idea but I doubt they would ever implement it since it will break many (most) websites.

]]> By: FilipM http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123673 FilipM Thu, 11 Sep 2008 12:51:56 +0000 https://www.gnucitizen.org/?p=1250#comment-123673 @ Erlend: I understand your concern, but if session cookies (and sessions in general) aren't shared between tabs, there would be no possibility for child-sessions or childprocesses communicating with the parent. Although I'm not fund of the use of childprocesses, somethimes they come in handy. Lots of webapps would have to be rewritten, even the encrypted onces. @ Erlend:
I understand your concern, but if session cookies (and sessions in general) aren’t shared between tabs, there would be no possibility for child-sessions or childprocesses communicating with the parent. Although I’m not fund of the use of childprocesses, somethimes they come in handy. Lots of webapps would have to be rewritten, even the encrypted onces.

]]> By: Erlend http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123669 Erlend Thu, 11 Sep 2008 07:39:06 +0000 https://www.gnucitizen.org/?p=1250#comment-123669 I like the idea of having an encrypted mode. One of the things that puzzles me about Chrome, is that even though the tabs run as different processes, session cookies are still shared between the tabs. If they were not shared, that might make XSRF harder, because the sessions were not available when visiting a malicious site in another tab. I like the idea of having an encrypted mode. One of the things that puzzles me about Chrome, is that even though the tabs run as different processes, session cookies are still shared between the tabs. If they were not shared, that might make XSRF harder, because the sessions were not available when visiting a malicious site in another tab.

]]> By: NurBo http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123667 NurBo Thu, 11 Sep 2008 03:59:36 +0000 https://www.gnucitizen.org/?p=1250#comment-123667 Yeah the Google Chrome browser is a great piece of work but they still have a few big bugs to fix. And I also don't like how the browser itself doesn't support flash games and videos that we'll. But its the beta version :) Yeah the Google Chrome browser is a great piece of work but they still have a few big bugs to fix. And I also don’t like how the browser itself doesn’t support flash games and videos that we’ll. But its the beta version :)

]]> By: Clefty http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123665 Clefty Thu, 11 Sep 2008 01:38:03 +0000 https://www.gnucitizen.org/?p=1250#comment-123665 I think privacy is very important. I didn't realize there was that problem with leaking session identifiers. Do you think google will be fixing this soon (especially since you say it's a quick and easy fix)? That's one thing I'd like fixed before I fully commit to google chrome. I think privacy is very important. I didn’t realize there was that problem with leaking session identifiers. Do you think google will be fixing this soon (especially since you say it’s a quick and easy fix)? That’s one thing I’d like fixed before I fully commit to google chrome.

]]> By: Julian A. Rodriguez http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123663 Julian A. Rodriguez Wed, 10 Sep 2008 23:48:39 +0000 https://www.gnucitizen.org/?p=1250#comment-123663 yeah it's a very nice idea but the browser honestly sucks, they need first fix all the simple bugs and bofs in the software; your idea it's a good begin, btw "big company, bad software" I don't want to say that about google but something it's wrong here yeah it’s a very nice idea but the browser honestly sucks, they need first fix all the simple bugs and bofs in the software; your idea it’s a good begin, btw “big company, bad software” I don’t want to say that about google but something it’s wrong here

]]> By: pdp http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123657 pdp Wed, 10 Sep 2008 16:32:46 +0000 https://www.gnucitizen.org/?p=1250#comment-123657 yep, correct. the anti XSS and CSRF features should be global to all browser modes. yep, correct. the anti XSS and CSRF features should be global to all browser modes.

]]> By: Ryan Patterson http://www.gnucitizen.org/blog/improving-google-chrome/comment-page-1/#comment-123656 Ryan Patterson Wed, 10 Sep 2008 16:21:57 +0000 https://www.gnucitizen.org/?p=1250#comment-123656 Sure, it is a great idea, and it'd be easy to do in Firefox via an extension. But it doesn't protect you from either XSS attacks or CSRFs. Sure, it is a great idea, and it’d be easy to do in Firefox via an extension. But it doesn’t protect you from either XSS attacks or CSRFs.

]]>