Single Site Browsers [to be uploaded later]
It’s an interesting idea and I can’t disagree with the concept (<3 <3 separation of privilege) but I think it’s missing a few things. Here are some observations I made about it.
- They acknowledge that SSB’s do nothing against malware.
- It solves the problem of webpages bringing in resources from all over pretty nicely. Since the organization pushing the SSB knows whats on their own website they can easily publish a whitelist of allowed domains/content or even change their own site to be simpler in that regard.
- I think this might come down to a social problem. If I’ve got one general purpose browser I use every day (IE, Firefox, Safari) and I have it open right now, what is going to convince me to close my browser and open a new app just to get to a website that I already have bookmarked? There needs to be some incentive besides security tied into the SSB to get people to perform the above action or companies need to disable functionality on their public websites.
- I think the SSB idea is really just a crutch because people can’t implement robust security policies in a browser. Think “IE Zones” on steroids or even GreenBorder (wow when did they get bought out???).
Still, it’s kind of cool.
This work, unless otherwise expressly stated, is licensed under a Creative Commons Attribution 3.0 License.
Loading ...
Sound like something iTunes currently has. It integrates a ssb for itunes store..
There may always be a possibility of running unsafe activex code or java script on the single site from a compromised website. Maybe something like the “random js toolkit” attack recently. These kind of attacks would defeat the pupose of ssb.
I am assuming an external link in a site would trigger a new ssb browser. In this scenario wont you completely lose UI ? The interface is going to end up with too many windows scattered around.
Agreed, it is just a crutch but so are spam filters and firewalls. I think we will see lots of these being used to give the impression of security. Wouldn’t the average person feel better about logging into their bank account to pay bills from a stand alone app?
The recent Cross-site Request Forgery exploit in gmail comes to mind. I wouldn’t be surprised to see this type of thing being marketed as a fix for that type of attack.
Additionally, an easy method of creating your own would be great for internal websites that are not linking to other pages. This could provide a good solution for a public kiosk setting. For example, the school I work at wants to have 2 computers out that only go to our internal library database but don’t want the system to be used for other internet activities.