Block external font-face set #49
Conversation
| // an element that it should be hard to find/select/leak from/etc | ||
| export const hardened = invoker(creator({ | ||
| // decide on an unguessable font-family (non-existing) so an external one cannot be applied | ||
| 'font-family': rand(20), |
There was a problem hiding this comment.
Why not go even higher than 20?
There was a problem hiding this comment.
What number would be sufficient?
|
In a way, does this not serve to aid the vector it is addressing - by forcing defaults, a dictionary of common or known defaults can serve to also predict the height...? |
The problem was that without this setting, it was possible for attackers to change the height of specific chars (as opposed to all of them) which would provide feedback to the attacker on which chars exist and which don't (and in what order). With this change, all of LavaDome's chars obey the same height restriction, so telling their height from outside is possible, but it isn't useful to tell them apart, so in practice attackers gain no information from such tactic. |
Address #48