With 'Site Isolation' in use, the browser should be better protected from Spectra-like attacks designed to steal info such as log-on credentials.
With 'Site Isolation' in use, the browser should be better protected from Spectra-like attacks designed to steal info such as log-on credentials.
Google has switched on a defensive technology in Chrome that will make it much more difficult for Spectra-like attacks to steal information such as log-on credentials.
Called "Site Isolation," the new security technology has a decade-long history. But most recently it's been cited as a shield to guard against threats posed by Spectre, the processor vulnerability sniffed out by Google's own engineers more than year ago. Google unveiled Site Isolation in late 2017 within Chrome 63, making it an option for enterprise IT staff members, who could customize the defense to shield workers from threats harbored on external sites. Company administrators could use Windows GPOs - Group Policy Objects - as well as command-line flags prior to wider deployment via group policies.
Later, in Chrome 66, which launched in April, Google opened the field testing to general users, who could enable Site Isolation via the chrome://flags option. Google made clear that Site Isolation would eventually be made the default in the browser, but the firm first wanted to validate the fixes addressing issues that cropped up earlier testing. Users were able to decline to participate in the trial by changing one of the settings in the options page.
Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
Now, Google has switched on Site Isolation for the vast majority of Chrome users - 99% of them by the search giant's account. "Many known issues have been resolved since (Chrome 63), making it practical to enable by default for all desktop Chrome users," Charlie Reis, a Google software engineer, wrote in a post to a company blog.
Site Isolation, Reis explained, "Is a large change to Chrome's architecture that limits each renderer process to documents from a single site." With Site Isolation enabled, attackers will be prevented from sharing their content in a Chrome process assigned to a website's content.
"When Site Isolation is enabled, each renderer process contains documents from, at most, one site," Reis continued. "This means all navigations to cross-site documents cause a tab to switch processes. It also means all cross-site iframes are put into a different process than their parent frame, using 'out-of-process iframes.'" That, Reis added, was a major change to how Chrome works, and one that engineers had been pursuing for several years, long before Spectre was uncovered.