Norman noted that there are benefits beyond attack surface reduction – due to how the V8 JIT works, several impactful mitigation technologies do not work during the rendering process. “Balanced learns what sites you use often and trusts those, strict is well… strict,” Norman tweeted, adding that Edge users can also add their own exceptions. The SDSM feature also enables users to toggle between Balanced and Strict modes, giving them greater control over what is and isn’t enabled. Page load times, however, showed regressions averaging around 17%. Regressions showed an 11% increase in power consumption. Norman also noted that performance times are not significantly affected by disabling the engine, for example tests that measured improvements in power showed a 15% improvement on average. In order to defend against the plethora of bugs bundled with JIT, Super Duper Secure Mode disables the engine, removing “roughly half” of the issues present. JIT engines are commonly found to be vulnerable to security bugs, though Norman says that developers are willing to accept this cost because users want their browsers to be “fast”. This technology enables engines to convert JavaScript into machine code just before it is executed, resulting in huge gains in speed and usability, but losses for security. JavaScript engines are “a remarkably difficult security challenge for browsers”, explained Norman, partly due to the use of the Just-In-Time (JIT) compilation, also known as speculative optimization. V8 is an open source JavaScript engine which was developed by the Chromium Project for Google Chrome and Chromium web browser (the code base for recent versions of Edge).
Super Duper Secure Mode – also known as SDSM – helps to mitigate against browser attacks by disabling the Just-In-Time component in V8, a technology linked a large number of security vulnerabilities in recent years. Read more of the latest browser security news
Norman revealed on Twitter last night (November 22) that the feature has been rolled out “secretly” in the latest version. The feature was first mentioned back in August, in a blog post by Edge’s vulnerability research lead, Johnathan Norman. Microsoft has unveiled a ‘Super Duper Secure Mode’ in the latest version of Edge browser, offering users greater protection against common vulnerabilities. Browser goes further to protect against bugs by disabling JIT
0 kommentar(er)
