XS-Leaks (Cross-Site Leaks) Attacks Modern Web Browsers - Possible Mitigation

[XPerceniol]

Just for the record, I'm actually not paranoid and both browsers work/function very well and I feel they are secure (enough as can be) but perhaps lacking in other areas. I'm not at all worried; I realize some need to be concerned with privacy and (so called) anonymity and I get that, perhaps in repressed areas of the word, folks need to take this seriously. Its just good to know/realize that anything can be exploited these days; sad to say in this new internet world.

A bit dismayed that even our 360EE still gives me 20 red, but, again, it works very well and I don't know enough at all about Chrome to even begin to come up with solutions, but hopefully, in our effort(s) and continued development here, we'll improve overtime. They have worked very hard to make this even possible and we mustn't take their hard wok for granted.

 

Edited December 16, 2021 by XPerceniol

[msfntor]

On 12/14/2021 at 11:55 PM, msfntor said:

I do NOT use neither 3-rd party deny in uBlock, nor Origin Requests Only extension...

 

6 hours ago, XPerceniol said:

And the flag:

chrome://flags/#reduced-referrer-granularity

Thank you for this flag:

now, this flag enabled in DcBrowser, I've 10 Reds and 3 Not Applicable;

in 360Chrome 13.5 r 5: 12 Reds and 3 Not Applicable, with this flag, and 9 Reds without this flag changed, and not this same ones than in DcBrowser...

Edited December 16, 2021 by msfntor

[NotHereToPlayGames]

2 hours ago, vinifera said:

yeh... but if you disable JS then most sites wont work at all ...

JUST THE WAY I LIKE IT  

I allow JS on my banking and billpay, but the vast majority of the rest of my browsing experience is for READING the content on a web site, which works perfectly fine without JS BS (not "always", but good enough for me, I'll just go to a DIFFERENT source where I can READ the content without JS BS).

[vinifera]

6 hours ago, Tripredacus said:

Love these tests. My results.

Firefox 69.0.3 x64: test doesn't run with js disabled (my default state)
Firefox (same) with js enabled for xsinator.com only: 3/38 red (with 10 gray/loading state)

 

so with FF 69 you get only 3 reds
and with FF 95 considered "modern" i get 17

what the hell ...

[NotHereToPlayGames]

I confess that I've been ignoring this thread as just another one of those "too paranoid for me" types of tests.  (to each their own...)

But I finally ran it in my v11 and I'm happy with only FOUR reds without making any flag changes.

[msfntor]

4 minutes ago, NotHereToPlayGames said:

But I finally ran it in my v11 and I'm happy with only FOUR reds without making any flag changes.

- because v11 is not working properly (if I remember)?

[NotHereToPlayGames]

Working fine...  I will not allow TWO .js domains when the test will run with only ONE .js domain...  It is SELF-FULFULLING PROPHECY to "lower your shields" just to run a "test"...

The flag mentioned earlier INCREASED my reds from FOUR to FIVE.

[msfntor]

12 minutes ago, NotHereToPlayGames said:

The flag mentioned earlier INCREASED my reds from FOUR to FIVE.

 

43 minutes ago, msfntor said:

in 360Chrome 13.5 r 5: 12 Reds and 3 Not Applicable, with this flag, and 9 Reds without this flag changed, and not this same ones than in DcBrowser...

-but in DcBrowser, this flag enabled has decreased  Reds from 11 to 10..

Edited December 16, 2021 by msfntor

[NotHereToPlayGames]

Maybe it's one of those tests that if you run it 4 different times, you get 3 different results ???

[Nokiamies]

@NotHereToPlayGamessince you are privacy aware person I am curious what addons are using in your 360chrome?

I may have to give it a shot to access some sites that need newer js and wasm. I have used gecko based browsers for most of my life so not fully sure what works on chromium and even less on older one

[NotHereToPlayGames]

I tend to NOT use the "latest-and-greatest" version of most of my extensions ON PURPOSE.

Newer often times just means a newer "feature" was added.  But if that "feature" is a security/privacy risk, then all you did was shoot yourself in the foot thinking "it's newer, it has to be better".

Flags:  --disable-logging --no-default-browser-check --disable-component-update --disable-background-networking --allow-outdated-plugins --kiosk-printing --disable-print-preview --cipher-suite-blacklist=0xe013 --disable-webgl --js-flags=--noexpose_wasm

I do NOT use any uMatrix/uBlock "lists" (one that I used to use is still listed in my profile but unchecked).  I use MVPS HOSTS file but tend to only update once every six months or so.

A ton of site-specific uMatrix and NoScript rules not included below.  I rarely visit YouTube but since it has such a gigantic following amongst MSFN members I have two extensions just for a site I almost never visit.

 

Edited December 16, 2021 by NotHereToPlayGames

[XPerceniol]

2 hours ago, msfntor said:

 

-but in DcBrowser, this flag enabled has decreased  Reds from 11 to 10..

You're welcome, but he's right, enabling that flag decreases in DC and makes things worse in 360EE. I actually don't use DC browser because videos play better on 360 (for me). I notice they either skip or stop with the rotating circle on DC. I find  --disable-gpu --enable-strict-mixed-content-checking helped in 360. You say V11 isn't working correctly?
 

[XPerceniol]

1 hour ago, Mr.Scienceman2000 said:

@NotHereToPlayGamessince you are privacy aware person I am curious what addons are using in your 360chrome?

I may have to give it a shot to access some sites that need newer js and wasm. I have used gecko based browsers for most of my life so not fully sure what works on chromium and even less on older one

How can we be sure the addons aren't collecting our data. I don't know which ones to trust. I can disable js globally but most site won't load all the features.

Edited December 16, 2021 by XPerceniol

[NotHereToPlayGames]

11 minutes ago, XPerceniol said:

You say V11 isn't working correctly?

Test works for me in v11.  I don't think msfntor was claiming otherwise, he did have a question mark at the end when he posted that.

[NotHereToPlayGames]

2 hours ago, msfntor said:

- because v11 is not working properly (if I remember)?

Working for me.