From: Juliusz Chroboczek <jch@irif.fr>
To: "Michael Ströder" <michael@stroeder.com>
Cc: galene@lists.galene.org
Subject: [Galene] Re: "This operation is insecure"
Date: Mon, 01 Feb 2021 01:45:21 +0100 [thread overview]
Message-ID: <87pn1k39b2.wl-jch@irif.fr> (raw)
In-Reply-To: <8aea027c-63f9-9600-f084-dd3ebf569ef8@stroeder.com>
> Ok, following your advice I've successfully tested normal video
> conference with an Safari-on-iPad user and the following complete CSP
> header:
I'm a little concerned that if you tweak Galène's defaults, your bug
reports will be somewhat less useful to me than they would be otherwise.
So would you please explain what kind of attacks you're trying to avoid,
so we can converge on a common header that suits everyone?
> 1. disable frames.
Galène doesn't create frames. Galène's default CSP header forbids inline
Javascript, so even if an attacker somehow manages to get Galène to
include Javascript code in the DOM, it will be ignored.
> 2. limit connect-src to wss: because all traffic must be TLS encrypted.
Secure web pages are not allowed to connect to insecure WebSockets, even
when the CSP allows it.
> 3. tighten resource loading some more just in case some browsers might
> not obey default-src 'self'.
Are you aware of any such browsers?
-- Juliusz
next prev parent reply other threads:[~2021-02-01 0:45 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-27 18:24 [Galene] "This operation is insecure" Michael Ströder
2021-01-27 18:52 ` [Galene] " Michael Ströder
2021-01-27 20:05 ` Juliusz Chroboczek
2021-01-27 20:08 ` Juliusz Chroboczek
2021-01-27 20:17 ` Michael Ströder
2021-01-27 20:30 ` Juliusz Chroboczek
2021-01-27 21:09 ` Michael Ströder
2021-01-27 21:12 ` Michael Ströder
2021-01-27 21:42 ` Juliusz Chroboczek
2021-01-27 22:15 ` Michael Ströder
2021-01-28 13:11 ` Michael Ströder
2021-01-28 16:16 ` Michael Ströder
2021-02-01 0:45 ` Juliusz Chroboczek [this message]
2021-02-01 9:10 ` Michael Ströder
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.galene.org/postorius/lists/galene.lists.galene.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87pn1k39b2.wl-jch@irif.fr \
--to=jch@irif.fr \
--cc=galene@lists.galene.org \
--cc=michael@stroeder.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox