Read 20 remaining paragraphs | Comments

Google cherche à bloquer le vol de cookies sur le navigateur Chrome, une technique courante employée par les cybercriminels. Pour cela, la société américaine introduit une nouvelle norme d'authentification sur les appareils.

Imaginez un monde où vos précieux cookies d’authentification, ces petits fichiers qui vous permettent de rester connecté à vos sites préférés, seraient à l’abri des vilains pirates informatiques. Et bien, mes chers amis geeks, ce monde est sur le point de devenir réalité grâce à notre cher Google et sa nouvelle fonctionnalité révolutionnaire pour Chrome : Device Bound Session Credentials (DBSC) !

Fini le temps où ces satanés cybercriminels pouvaient subtiliser nos cookies et prendre le contrôle de nos comptes en un clin d’œil. Avec cette nouvelle fonctionnalité qui arrive dans Chrome et qui s’appelle Device Bound Session Credentials (DBSC), vos cookies seront liés cryptographiquement à votre appareil, rendant leur vol aussi utile qu’un sabre laser sans piles.

Lors d’un processus d’authentification, une paire de clés publique/privée unique est générée en utilisant la puce TPM (Trusted Platform Module) de votre appareil. Ainsi, la clé privée reste bien au chaud dans votre machine, impossible à exfiltrer, tandis que la clé publique est partagée avec le serveur. Comme ça, même si un hacker met la main sur vos cookies, sans la clé privée associée, il ne pourra pas accéder à vos comptes.

Bien sûr, DBSC ne sera pas parfait dès le départ et les chercheurs en sécurité tenteront sûrement de trouver un moyen de contourner cette protection comme à chaque fois, mais Google est confiant.

Kristian Monsen, ingénieur de l’équipe Chrome Counter Abuse, affirme que DBSC devrait « considérablement réduire le taux de réussite des malwares voleurs de cookies « . Les attaquants seront donc obligés d’agir localement sur l’appareil, ce qui rendra la détection et le nettoyage plus efficaces. En gros, ça va leur mettre des bâtons dans les roues comme jamais !

Selon leur calendrier prévisionnel , DBSC devrait être pris en charge, fin 2024, par environ la moitié des appareils Desktop équipés de Chrome. En attendant le grand jour, vous pouvez déjà tester DBSC en allant dans chrome://flags/ et en activant le flag « enable-bound-session-credentials » sur Windows, Linux et macOS.

Bonne nouvelle non ?

Source

Google pourrait mettre fin à la récolte de données sur ses utilisateurs lorsqu'ils utilisent la navigation privée.

Suit claimed tech giant tracked activity of people who thought they were privately using its Chrome browser’s incognito mode

Google agreed to destroy billions of records to settle a lawsuit claiming it secretly tracked the internet use of people who thought they were browsing privately in its Chrome browser’s incognito mode.

Users alleged that Google’s analytics, cookies and apps let the Alphabet unit improperly track people who set Google’s Chrome browser to “incognito” mode and other browsers to “private” browsing mode.

Continue reading...

Google change de méthode pour renforcer la détection des sites potentiellement malveillants, et cela implique d'analyser toutes les URL qui passent par le navigateur web le plus populaire du marché. Mais l'entreprise assure que cela ne pose pas de problème de confidentialité.

An anonymous reader quotes a report from Android Police: Seven years ago, Google announced that it would phase out all Chrome apps on Windows, Mac, and Linux by 2018 (it would actually take until 2023). In its place would be what the company called Progressive Web Apps (PWAs), web apps that can be installed on a user's desktop that act as if they are practically natural apps and programs. The idea grew quickly, with Chrome users having installed PWAs in record numbers by the beginning of 2022. Soon, every website will be installable on desktops through PWAs. In Chrome Canary (the daily build version of Google Chrome and typically a couple of versions ahead of the stable build), websites can now be installed on desktops. As part of the latest daily build, Google has added an "Install page as app" option to the "Save and share" submenu on the desktop version (via @Leopeva64 on X). This makes clicking the app -- which is just the website made to look and feel like a native app -- always open in its own window. Sites that already have their own PWAs, like YouTube or Reddit, have been prompting users to install them for a while now and will have their "Install page as app" function actually showing the name of the site. For example, YouTube's entry will show as "Install YouTube." In February, it became possible to enable the flags necessary to make any website into a PWA, but it seems to have just now become fully implemented.

Read more of this story at Slashdot.

Chrome 124 Lets You Turn Any Website Into an App

The Chromium team is prototyping Web Monetization to allow websites to automatically receive micro payments from visitors for their content, bypassing traditional ad or subscription models. The Register reports: Earlier this month, Alexander Surkov, a software engineer at open source consultancy Igalia, announced the Chromium team's intent to prototype Web Monetization, an incubating community specification that would let websites automatically receive payments from online visitors, as opposed to advertisers, via a web browser and a designated payment service. "Web monetization is a web technology that enables website owners to receive micro payments from users as they interact with their content," Surkov wrote in an explanatory document published last summer. "It provides a way for content creators and website owners to be compensated for their work without relying solely on ads or subscriptions. Notably, Web Monetization (WM) offers two unique features -- small payments and no user interaction -- that address several important scenarios currently unmet on the web." "Open Payments API is an open HTTP-based standard created to facilitate micro transactions on the web," wrote Surkov. "It is implemented by a wallet and enables the transfer of funds between two wallets. It leverages fine-grained access grants, based on GNAP (Grant Negotiation and Authorization Protocol), which gives wallet owners precise control over the permissions granted to applications connected to their wallet." The basic idea is web users will get a digital wallet, provided by Gatehub and Fynbos presently, and web publishers will add a link tag to their site's block formatted like so: . Thereafter, site visitors who have linked their digital wallet to their browser will pay out funds to the requesting publisher, subject to the browser's permissions policy.

Read more of this story at Slashdot.

Chrome Engine Devs Experiment With Automatic Browser Micropayments

Read 3 remaining paragraphs | Comments