RE: Partial SOP Bypass via W3 Standards

The PGP key is here: https://technet.microsoft.com/en-us/security/dn606155.aspx


From: Angelo Liao
Sent: Monday, September 11, 2017 10:35 AM
To: 'Mike West' <mkwst@google.com>; David Dworken <david@daviddworken.com>; public-webappsec@w3.org
Subject: RE: Partial SOP Bypass via W3 Standards

For security bugs on Edge/IE, you can email the secure@microsoft.com<mailto:secure@microsoft.com> alias and we will respond accordingly. You can also submit bugs through https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/.


From: Mike West [mailto:mkwst@google.com]
Sent: Monday, September 11, 2017 7:24 AM
To: David Dworken <david@daviddworken.com<mailto:david@daviddworken.com>>; public-webappsec@w3.org<mailto:public-webappsec@w3.org>
Subject: Re: Partial SOP Bypass via W3 Standards

I'd suggest filing bugs with vendors. For Chrome, that's https://bugs.chromium.org/p/chromium/issues/entry?template=Security%20Bug. We can coordinate cross-vendor discussions privately if necessary.

On Mon 11. Sep 2017 at 16:07, David Dworken <david@daviddworken.com<mailto:david@daviddworken.com>> wrote:
Hi,

I have discovered a partial SOP bypass that works in every browser due to a fundamental flaw in the W3 standards (for the time being, reach out to me individually if you need to see the proof of concept). Is this the correct place to open a discussion on how to fix or mitigate this flaw? Or is there a limited subset of trusted W3 members I should include in the discussion? Or should I send in bug reports to individual browser vendors?

Thanks,
David Dworken
--
-mike