Rendered at 12:05:34 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ashurandi 51 seconds ago [-]
Would a hard isolation model for HTML email be a better long-term solution, or is that impractical for reasons I’m missing?
PoignardAzur 10 minutes ago [-]
Reading the article, I kept thinking: "could you defeat this with an iframe?", and indeed:
> One of the best methods to protect against these attacks is strict isolation. If you isolate the email message using sandboxed iframes you restrict the ability to break out of trusted boundaries. If you are not using sandboxed iframes, always be careful when allowing custom attributes and check for HTML/CSS gadgets. Use a strict allow list of characters when validating keywords and names to avoid mutation when using the CSSOM.
iframes should be the first layer of any defense-in-depth against user-submitted content.
desro 13 minutes ago [-]
Allowing anything other than plain text in email bodies was a terrible mistake.
fragmede 45 minutes ago [-]
> In this section I targeted Fastmail, ProtonMail, Gmail, Cowork and Slack.
Oh that's all, is it?
pluc 35 minutes ago [-]
> This page requires JavaScript for an enhanced user experience.
Yeah no shit.
thunderbong 26 minutes ago [-]
You're certainly welcome to browse the internet without JavaScript.
But when most of the articles submitted here don't work without JavaScript, this comment seems really irrelevant.
> One of the best methods to protect against these attacks is strict isolation. If you isolate the email message using sandboxed iframes you restrict the ability to break out of trusted boundaries. If you are not using sandboxed iframes, always be careful when allowing custom attributes and check for HTML/CSS gadgets. Use a strict allow list of characters when validating keywords and names to avoid mutation when using the CSSOM.
iframes should be the first layer of any defense-in-depth against user-submitted content.
Oh that's all, is it?
Yeah no shit.
But when most of the articles submitted here don't work without JavaScript, this comment seems really irrelevant.