Conversation

Replying to

For the secure messaging example, it can be isolated per contact, and handling things like audio / video decoding for video calls can be isolated, as can cryptography, etc. Finer grained isolation than a group of applications for a certain identity / task is very important.

Replying to

and

I think this approach is really less about containment and more about reducing the complexity of data formats exchanged between subsystems. Even the strong isolation of Qubes relies on the idea of simplified formats used at critical points.

Replying to

and

It's fine-grained isolation of different components. Improving that involves having minimal attack surface exposed between the components, simple data formats and a focus on hardening the code most exposed at the boundaries with safe tools, etc.

Replying to

Isolating per-contact in a messaging client, per-site in a browser, etc. is applying the same principle of QubesOS at a fine-grained level using existing privacy/security boundaries. Since they're existing boundaries, it doesn't require the user to do anything or be aware of it.

Replying to

and

OK re per-contact-site isolation.... Now, demote "kernel" to "services" and look to hypervisor+qrexec as the actual kernel.

Replying to

and

There are implementations of fine-grained isolation within applications using different mechanisms than OS sandboxing. Architecture-level virtualization is one possible approach and has pros / cons, as do other approaches like a higher-level virtual machine, etc.

Replying to

The isolation between sites in a browser or contacts in a messaging app are good examples of existing fine-grained trust boundaries to reinforce. There are a lot of other examples and reinforcing those can improve security for a billion users with no more work on their part.

Replying to

and

IDK if that's literally true. The move to https was itself a form of site isolation & industry was tinkering with hiding URLs altogether when they did about-face out of necessity. We might not have Chrome internal isolation today if not for trend reinforcing site identity in UI.

Replying to

and

The domain is the site identity. Marking EV identity is on the way out because it isn't actually truly meaningful / helpful for users. They don't know where companies are registered and those names aren't unique while domain names are unique.

Replying to

and

Whether or not EV is valuable is open to debate; still an attempt was made to enhance security through UI and make web site identity more distinct.

Replying to

and

The domain is the distinct identity. EV was an attempt to tie it to real world identities of companies but it can't achieve that goal due to company names not being unique and users not knowing where companies are registered or the full legal naming of the corporation.

7:25 PM · Oct 30, 2018Twitter Web Client