RE: ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally?

Well, actually on further thought, I guess whether it responds to synthetic events or not should be another open issue, and that would have interesting impacts on testability and/or the usefulness of a binary-search side channel attack to read screen contents outside the frame.

From: Hill, Brad [mailto:bhill@paypal-inc.com]
Sent: Sunday, November 04, 2012 11:37 PM
To: Fred Andrews; Web Application Security Working Group
Subject: RE: ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally?

Screenshots are never sent over the web - that would be an extreme privacy violation.  The comparison is exclusively a local one.  This does possibly provide a side-channel to infer information about the user's screen, but as reports would only be generated in response to non-synthetic UI events, it would be a very low bandwidth channel.   It would be interesting to think systematically about what the exact bandwidth is and what could be practically accomplished with this.

For some context, until I get around to filling in details from the F2F discussion on our issues list, the question here was whether OS-level screenshots provide any protections that cannot be accomplished without their use.  The InContext research used OS-level screenshots to detect attacks involving multiple overlaid browser windows (as opposed to frames), in which users were instructed to "double click" on a target, where the first click closes the topmost window and the second click is then delivered to the window beneath before the user can assess its context.

Giorgio thought that monitoring the timing of paint events could solve this without recourse to OS-level views, and if true, this might greatly simplify issues with accessibility tools, as implementing the pixel comparison heuristic only in terms of browser renders might avoid interference from OS-level tools like screen magnifiers or high-contrast color schemes.

-Brad
From: Fred Andrews [mailto:fredandw@live.com]
Sent: Sunday, November 04, 2012 8:13 PM
To: Web Application Security Working Group
Subject: RE: ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally?


Technically, the more information available to a remote service the better they could monitor for 'attacks'.  If a browser level screenshot does not show extension overlays, chrome overlays, tool bar overlays, plugins, etc then attacks from these could be detected.  I presume a browser level screenshot does not include overlays from other OS level processes, so an OS level screenshot could help detect attacks from these.

My personal view is that even the UA presentation should be a private matter for the user and that the 'platform' should not support this as a default.  An OS level screenshot has the potential to expose a lot of information about the user that their may well consider private.

Some users may well want to take an OS level screenshot and send it over the web, but surely the UA UI could make sure this is an intentional opt-in action.

cheer
Fred
> Date: Thu, 1 Nov 2012 16:40:49 +0000
> To: public-webappsec@w3.org<mailto:public-webappsec@w3.org>
> From: sysbot+tracker@w3.org<mailto:sysbot+tracker@w3.org>
> Subject: ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally?
>
> ISSUE-28: What specific attacks are prevented by OS screenshots, should this be recommended against generally?
>
> http://www.w3.org/2011/webappsec/track/issues/28
>
> Raised by:
> On product:
>
>
>
>
>