Hacker News new | ask | show | jobs
by junek 500 days ago
OK, fun. What can we do to mitigate this until it gets patched?
3 comments

Serious answer, don't use Safari. Use a browser that properly separates webpages into isolated processes so that this kind of cross-site read is not possible.
There’re no other browsers on iPhone. Every iPhone browser is a reskin of Safari. They’re in theory supposed to allow other browsers in the EU, but AFAIK it has not happened yet.
Then don't use an iPhone until it is patched.
What about turn JS off on your favourite iOS browser?
That wouldn't prevent possible malware apps using WKWebview from getting out of the jail they are running out right?
Yes, I agree.

However I also expect that Swift-compiled apps can do this without a web browser component.

It’s a different threat model though, having installed a malicious app vs browsing a malicious site.

No need to turn JS off. Turn on Lockdown mode which disables Javascript JIT and WASM, which might be enough
It’s not.
Brave on iOS can limit Javascript to trusted sites.
So could this hypothetically open a mail client on your iPhone and read your emails?
No, it doesn’t do cross-address space attacks.
God I hate Apple sometimes
Will that work? Isn't memory treated in a unified way between processes, at some point?
Processors are not supposed to speculate across ASIDs
It will work unless someone forgets to add a public suffix into the public suffix list (as described in the FLOP paper). Both of these attacks target virtual memory pointers.
From the FAQ:

> While FLOP has an actionable mitigation, implementing it requires patches from software vendors and cannot be done by users. Apple has communicated to us that they plan to address these issues in an upcoming security update, hence it is important to enable automatic updates and ensure that your devices are running the latest operating system and applications.

I wonder if Lockdown Mode would help?
IIRC, it disables jit and webassembly, so i think yes