Google to kill man-in-the-middle attacks

Powered by SC Magazine
 

Chromium updates.

Google Chrome researchers have announced Chromium updates to tackle man-in-the-middle attacks, focusing on “mixed scripting” vulnerabilities.

These vulnerabilities occur when a page served over HTTPS loads a script, CSS or plug-in resource over HTTP.

“A man-in-the-middle attacker (such as someone on the same wireless network) can typically intercept the HTTP resource load and gain full access to the website loading the resource. It’s often as bad as if the web page hadn’t used HTTPS at all,” read a blog post from Chris Evans and Tom Sepez - members of the Google Chrome Security Team.

They announced blocking mixed scripting conditions by default would be trialled in the first Chromium 14 canary release, meaning it could appear in the Google Chrome browser in future releases.

An infobar showing when a script is being blocked will also be added.

“As a user, you can choose to reload the website without the block applied. Ideally, in the longer term, the infobar will not have the option for the user to bypass it,” the Google researchers said.

“Our experience shows that some subset of users will attempt to ‘click through’ even the scariest of warnings - despite the hazards that can follow.”

Tracking your identity

In another security play, Google introduced a new tool to help users monitor their identity on the internet.

Called ‘Me on the Web,’ the feature can be found within Google Dashboard beneath the account details link.

Me on the Web notes mentions of users’ names or email addresses in websites and news stories.

“Me on the Web also provides links to resources offering information on how to control what third-party information is posted about you on the web,” said Andreas Tuerk, Google product manager, in a blog post.

“These include common tips like reaching out to the webmaster of a site to ask for the content to be taken down, or publishing additional information on your own to help make less relevant websites appear farther down in search results.”

Copyright © ITPro, Dennis Publishing


Google to kill man-in-the-middle attacks
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1079

Vote