{"id":1931,"date":"2015-01-05T07:57:44","date_gmt":"2015-01-05T07:57:44","guid":{"rendered":"http:\/\/revoscience.com\/en\/?p=1931"},"modified":"2015-01-05T07:57:44","modified_gmt":"2015-01-05T07:57:44","slug":"new-security-system-extends-firefox-and-chrome-to-make-internet-safer","status":"publish","type":"post","link":"https:\/\/www.revoscience.com\/en\/new-security-system-extends-firefox-and-chrome-to-make-internet-safer\/","title":{"rendered":"New Security System Extends Firefox and Chrome to make Internet Safer"},"content":{"rendered":"
\"David<\/a>
David Mazieres, an associate professor of computer science at Stanford<\/figcaption><\/figure>\n

Stanford computer scientists have extended two popular Web browsers to empower Web developers to deliver creative new services while also make surfing safer. The team added a security system called COWL, or Confinement with Origin Web Labels, to Firefox and Chrome to manage how data is shared. It prevents malicious computer code from leaking sensitive information and, at the same time, allows Web applications to display content drawn from multiple sources \u2014 an essential function for modern, feature-rich Web applications.<\/span><\/p>\n

A preliminary version of Firefox with COWL is available for download at the project\u2019s\u00a0Web site<\/span><\/a>. Researchers are encouraging developers to try it.<\/span><\/p>\n

\u201cIf browsers supported COWL, then we would be able to use that instead of the subpar mix of current technologies and actually feel confident in the security of our environment,\u201d said Pamela Fox a teacher at Khan Academy who was not involved in the new work.<\/span><\/p>\n

The researchers, led by\u00a0David Mazieres<\/span><\/a>, an associate professor of\u00a0computer science<\/span><\/a>\u00a0at Stanford, and Ph.D. student Deian Stefan, reported on COWL and several case studies in a paper published in the\u00a0Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation<\/em>. The new security system arose from a collaboration with researchers at University College London (UCL), Chalmers University of Technology in Sweden, Mozilla Research and Google.<\/span><\/p>\n

Third party code<\/strong><\/span><\/p>\n

COWL is a response to an online trend: Web developers using code they didn\u2019t write themselves.<\/span><\/p>\n

\u201cReusing existing code is part of the reason the Web is so successful. Unfortunately, using third-party code is also a security and privacy concern. Unless you are on the scale of Google, you can\u2019t afford to rewrite everything to eliminate this concern,\u201d Stefan said. At least 77 percent of the top 10,000 Web sites use code written by third-party developers. This means harmful code could potentially reach our browsers, the team said.<\/span><\/p>\n

COWL adds a layer of security on top of existing safety mechanisms to ensure that harmful code cannot leak private user data. Specifically, it addresses how data is handled by JavaScript, a common Web programming language that runs right in the browser.<\/span><\/p>\n

\u201cCOWL achieves both better privacy for the user and better flexibility for the Web developer,\u201d said Brad Karp, a computer systems and network professor at UCL and a coauthor of the paper.<\/span><\/p>\n

A Military Connection<\/strong>\u00a0<\/span><\/p>\n

At the heart of this layer of security is the idea of confinement with mandatory access control, or MAC, an idea that has been around since the 1970s. On old military mainframes, MAC meant that users who were allowed to read top secret files could not also edit files with lower clearance. This prevented sensitive information from being spread, intentionally or not.<\/span><\/p>\n

The Stanford computer scientists embedded MAC into Firefox and Chrome. They also provided a way for Web developers to use the new security system in their JavaScript programs.<\/span><\/p>\n

The key was figuring out how to make sure JavaScript code didn\u2019t share data with sites it wasn\u2019t supposed to. The team solved this problem by requiring developers to give their data labels specifying which Web sites could read and use the data. The labels follow the data, even when it\u2019s shared, and COWL ensures that no code ignores the labels.<\/span><\/p>\n

Personal finance case study<\/strong><\/span><\/p>\n

To illustrate the practical applications of COWL and the use of labels, the team included four case studies in the paper.<\/span><\/p>\n

In one, they proposed a Web application that a personal finance site, such as Mint.com, could offer. It would run locally, right in the browser, to automatically reconcile receipts from an online retailer with credit card charges. COWL could make sure that the app didn\u2019t leak sensitive information to Mint or another server.<\/span><\/p>\n

Currently, personal finance Web apps require users to provide bank usernames and passwords. Then, the applications log in to bank and credit card sites on the user\u2019s behalf.<\/span><\/p>\n

It means that the app\u00a0\u2014\u00a0and all the code it relies on\u00a0\u2014\u00a0must be trusted not to share the data. Today\u2019s security mechanisms only give developers control over who they share data with, not what happens to the data once it\u2019s been shared. This is precisely the situation COWL was designed to address.<\/span><\/p>\n

Imagine that instead of providing the Web app with your username and password, you first separately logged in to your bank and online retailer accounts. The app could recognize that you\u2019ve logged in\u00a0\u2014\u00a0for example, through a cookie, which is temporary data stored in your browser that Web sites use to keep users logged in\u00a0\u2014\u00a0and request information from the retailer and the bank.<\/span><\/p>\n

With COWL, the retailer and the bank can send back data with a label that allows only the app to read it. COWL also prevents the app from sharing the data somewhere else.<\/span><\/p>\n

To inspect the bank statements or purchase history, the finance app must peel off the label. Once this happens, COWL confines the code by restricting it from communicating with any servers. This ensures that the bank and Amazon statements cannot be leaked.<\/span><\/p>\n

On the road to a standard<\/strong><\/span><\/p>\n

The question that remains is how to convince Web developers to start using COWL.<\/span><\/p>\n

Before gaining widespread adoption, new Web technologies are reviewed by the World Wide Web Consortium, or W3C, a group of companies\u00a0\u2014\u00a0including Google, Mozilla, Microsoft and Facebook\u00a0\u2014\u00a0academic institutions and public members that recommends new standards for the Web. The W3C specifies many standards, including those for HTML and CSS, two important computer languages for designing Web sites.<\/span><\/p>\n

The team said the next step is to get COWL through the process of standardization, which takes about a year. The goal is to have the first public draft of the standard ready by January.<\/span><\/p>\n

“We could put our two modified Web browsers on the Internet, but that wouldn’t change the world,” Mazieres said.<\/span><\/p>\n

Through Stanford, Stefan has secured a spot for discussing COWL in one of the W3C\u2019s working groups on Web Application Security. This group has worked on a number of other specifications, including Content Security Policy and Mixed Content, which are already improving the state of Web security.<\/span><\/p>\n

One major plus for COWL is that it\u2019s backward compatible. The team built it so that existing, less secure apps will run without a problem. They are hopeful that the ideas in COWL will catch on.<\/span><\/p>\n

“Ideally, the general idea of confinement will trickle into other Web standards as well,\u201d said coauthor Alejandro Russo, a computer science professor at Chalmers University of Technology who is currently visiting Stanford.<\/span><\/p>\n

In addition to Mazieres, Stefan, Karp and Russo, the paper had three other authors: Edward Yang, a PhD student in computer science at Stanford; Petr Marchenko, a researcher at Google; and Dave Herman, the director of strategy at Mozilla Research. John Mitchell, a Computer Science professor at Stanford, is involved with the project but was not an author of the paper.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Stanford computer scientists have extended two popular Web browsers to empower Web developers to deliver creative new services while also make surfing safer. The team added a security system called COWL, or Confinement with Origin Web Labels, to Firefox and Chrome to manage how data is shared. It prevents malicious computer code from leaking sensitive […]<\/p>\n","protected":false},"author":6,"featured_media":1932,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43],"tags":[],"class_list":["post-1931","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-computer-science"],"featured_image_urls":{"full":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"thumbnail":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml-150x150.jpg",150,150,true],"medium":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml-300x217.jpg",300,217,true],"medium_large":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"large":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"1536x1536":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"2048x2048":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"ultp_layout_landscape_large":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"ultp_layout_landscape":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"ultp_layout_portrait":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"ultp_layout_square":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"newspaper-x-single-post":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"newspaper-x-recent-post-big":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"newspaper-x-recent-post-list-image":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",90,65,false],"web-stories-poster-portrait":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",320,232,false],"web-stories-publisher-logo":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",96,70,false],"web-stories-thumbnail":["https:\/\/www.revoscience.com\/en\/wp-content\/uploads\/2015\/01\/David_Mazieres_associate_professor_computer_science_Stanford_University_ml.jpg",150,109,false]},"author_info":{"info":["Amrita Tuladhar"]},"category_info":"Computer Science<\/a>","tag_info":"Computer Science","comment_count":"0","_links":{"self":[{"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/posts\/1931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/comments?post=1931"}],"version-history":[{"count":0,"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/posts\/1931\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/media\/1932"}],"wp:attachment":[{"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/media?parent=1931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/categories?post=1931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.revoscience.com\/en\/wp-json\/wp\/v2\/tags?post=1931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}