{"id":838,"date":"2022-01-25T13:00:00","date_gmt":"2022-01-25T20:00:00","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=838"},"modified":"2022-01-23T15:31:41","modified_gmt":"2022-01-23T22:31:41","slug":"apple-we-have-standards-for-a-reason","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/01\/25\/apple-we-have-standards-for-a-reason\/","title":{"rendered":"Apple, we have standards for a reason…"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

So Apple, one of the largest corporations in the world, leaders in technology, full of some of the smartest people ever born, have been building software for decades. Obviously Apple knows about modern security protocols and Policies in their field, using them adequately whenever needed… right?<\/p>\n\n\n\n

This was a bug discovered at the end of November last year by the developers of FingerprintJS, A library used to identify specific machines better then with cookies or local files. When the developers discovered this bug, they had reported it to Apples bug tracker. <\/p>\n\n\n\n

Some of the Background Information<\/h2>\n\n\n\n

The bug itself is relatively harmless, but due to how it has violated a standard in internet protocol, many issues have arisen because of it, some of them leading to you being able to be identified, even across different accounts. To talk about this bug, first we need to talk about Same-Origin Policy(SOP).<\/p>\n\n\n\n

Websites, will use databases, usually implemented with IndexedDB (IDB), to store information on your computer, like preferences, details about what you did and other information. The information stored in these databases does not particularly matter for the bug, but the important thing is that any website can only see the databases that is in its tab. This means that if you have Facebook in one tab and Twitter in another, then they cannot see that there is another database, since they are in different frames.<\/p>\n\n\n\n

Now the issue…<\/h2>\n\n\n\n
\"\"
Data Leak: Source: https:\/\/www.flickr.com\/photos\/111692634@N04\/15857168437\/<\/figcaption><\/figure>\n\n\n\n

On Webkit 15, Apples browser engine, it stores data using an implementation of IDB. The people that found this bug put it quite well saying <\/p>\n\n\n\n

“Every time a website interacts with a database, a new (empty) database with the same name is created in all other active frames, tabs, and windows within the same browser session.”<\/p>FingerprintJS: https:\/\/fingerprintjs.com\/blog\/indexeddb-api-browser-vulnerability-safari-15\/<\/cite><\/blockquote>\n\n\n\n

Why was it designed this way?<\/h2>\n\n\n\n

Now the question is why engineers at Apple made this decision? I am going to give some ideas on what thought processes may have lead to this, but do note that these are just theories, any of which are incredible unlikely to be accurate. These kinds of issues are not usually caused by one decision but a multitude of decisions and reasons.<\/p>\n\n\n\n