![A Look at 30 Key Cyber Crime Statistics [2023 Data Update]](https://www.thesslstore.com/blog/wp-content/uploads/2022/02/cyber-crime-statistics-feature2-75x94.jpg)
(No Ratings Yet)
Loading...Browser Watch: SSL and Security Changes in Chrome 59
Security Changes in Chrome 59: worker-src support, rate limits on permission requests and headless chrome…
It’s time to talk security changes in Chrome 59. In this release, Google went pretty light on changes directly related to SSL/TLS, so we have included other changes that developers who work with SSL and HTTPS may be interested in.
The biggest on-going event in the industry is Symantec’s mis-issuance troubles. Google, Mozilla, and other root programs are still deciding how to handle these issues. The proposals put forth by Google and Mozilla would require Symantec to partner with a third-party CA to handle certificate issuance while it improves its own operations and get new roots trusted.
Because Google is still working on finalizing its plans, there are no changes related to the trust of Symantec certificates in this release.
In addition to the changes listed below, three URL spoofing bugs were also fixed (one with “high” severity). Chrome’s policy is to withhold the details of those bugs for 14 weeks so that the majority of users can safely update their browsers.
Here are some of the biggest security changes in Chrome 59:
Venafi Gen2 CT Log Added:
Venafi’s Gen2 log is now trusted by Chrome. It accepts certificates from all roots trusted by Chrome. Earlier this year, Venafi had a log removed from Chrome after suffering stability problems.
Support Added for worker-src
Worker-src is a directive for Content Security Policy (CSP) Level 3. It allows websites to restrict acceptable URLs/origins for Workers, SharedWorker, and ServiceWorker.
Worker-src is defined here in the CSP Level 3 spec.
Support Dropped for FTP Subresources
Pages loading over HTTP/HTTPS will no longer be allowed to load resources from the ftp:// protocol. An example of this would be the URL “http://example.com/index.html” attempting to load “ftp://example.com/image.jpeg.”
Chrome 59 is totally blocking this behavior, and ultimately wants to remove native FTP support altogether.
Temporary Rate Limit on Permission Requests:
To stop websites from spamming permission requests, Chrome will now temporarily stop all requests after the third dismissal of a prompt. After the 3rd dismissal, future requests will be stopped for a week. Each further dismissal will re-activate the 1-week ‘cooldown.’
Block Specific Network Requests in Dev Tools
A new feature in Chrome’s Developer Tools allows you to block resources based on its request URL or file type. This is helpful for testing how a site performs when a specific resource is blocked and can be used to simulate certain origins being offline. You can use wildcard functionality to block entire file types, such as “*.css.”
Google’s regular What’s New in DevTools update has more on this feature.
Headless Chrome has Shipped
A “headless environment” is an interface that lacks a GUI and is instead console based. A headless browser is all the components of a browser without the GUI. It is designed for development, automated testing, and other automated tasks that don’t require user interaction via a GUI.
For example, you could use a headless browser to automatically connect to a URL at set intervals and take screenshots of the page for archiving or monitoring.
Headless Chrome is available for Linux and Mac in Chrome 59. Windows compatibility will be coming later.
To learn more about headless Chrome, check out this article from Google.
5 Ways to Determine if a Website is Fake, Fraudulent, or a Scam – 2018
in Hashing Out Cyber SecurityHow to Fix ‘ERR_SSL_PROTOCOL_ERROR’ on Google Chrome
in Everything EncryptionRe-Hashed: How to Fix SSL Connection Errors on Android Phones
in Everything EncryptionCloud Security: 5 Serious Emerging Cloud Computing Threats to Avoid
in ssl certificatesThis is what happens when your SSL certificate expires
in Everything EncryptionRe-Hashed: Troubleshoot Firefox’s “Performing TLS Handshake” Message
in Hashing Out Cyber SecurityReport it Right: AMCA got hacked – Not Quest and LabCorp
in Hashing Out Cyber SecurityRe-Hashed: How to clear HSTS settings in Chrome and Firefox
in Everything EncryptionRe-Hashed: The Difference Between SHA-1, SHA-2 and SHA-256 Hash Algorithms
in Everything EncryptionThe Difference Between Root Certificates and Intermediate Certificates
in Everything EncryptionThe difference between Encryption, Hashing and Salting
in Everything EncryptionRe-Hashed: How To Disable Firefox Insecure Password Warnings
in Hashing Out Cyber SecurityCipher Suites: Ciphers, Algorithms and Negotiating Security Settings
in Everything EncryptionThe Ultimate Hacker Movies List for December 2020
in Hashing Out Cyber Security Monthly DigestAnatomy of a Scam: Work from home for Amazon
in Hashing Out Cyber SecurityThe Top 9 Cyber Security Threats That Will Ruin Your Day
in Hashing Out Cyber SecurityHow strong is 256-bit Encryption?
in Everything EncryptionRe-Hashed: How to Trust Manually Installed Root Certificates in iOS 10.3
in Everything EncryptionHow to View SSL Certificate Details in Chrome 56
in Industry LowdownPayPal Phishing Certificates Far More Prevalent Than Previously Thought
in Industry Lowdown