[Galene] Re: "This operation is insecure"

["Michael Ströder" <michael@stroeder.com>]

On 1/27/21 10:42 PM, Juliusz Chroboczek wrote:
> Perhaps you could explain why you are munging the headers in the frontend.
> Is there an actual attack that you're concerned about?

I remember various pen-testing talks about attacking even via rogue
frames, CSS files and fonts, depending on browser versions. So it's IMHO
good practice to disable everything not really needed (least-privilege).
Same spirit why I'm using systemd's sand-boxing options [1] and an
AppArmor profile [2].

What you could do to prevent some of the attacks is to use Subresource
Integrity Hashes in HTML source [3]. Yes, it requires you to commit the
correct hashes in galene.html when changing any CSS, JS, font files
included from there.

> If so, then we should think together about avoiding the attack, 
> rather than having each user use their own idiosyncratic set of 
> security-related headers.
Agreed. Avoiding attacks is a primary goal for you as a developer of a
network service. And I appreciate that you take care. But you cannot
influence the client side or fix issues yet unknown.

E.g. the AppArmor profile is IMHO definitely a good mitigation against
recent sudo attack vector or similar. Yes, I've already updated sudo on
my systems. But we all learned about this only two days ago. The
AppArmor profile was in place before.

I'm super-concerned of this whole video conferencing stuff. Bad people
can do really weird stuff with this great tool. We had some cases here
in Germany were *very* inappropriate content was sent to pupils of an
elementary school during an online lesson. :-(

So better safe, than sorry.

Ciao, Michael.

P.S.: Yes, of course one of the Safari users asked me: "Why don't you
use Zoom?" (sigh...).

[1]
https://build.opensuse.org/package/view_file/home:stroeder:network/galene/galene.service?expand=1

[2]
https://build.opensuse.org/package/view_file/home:stroeder:network/galene/apparmor-usr.sbin.galene?expand=1

[3]
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity