Reimagining the Browser: Introducing Cloudflare Browser Isolation Beta(blog.cloudflare.com)
blog.cloudflare.com
Reimagining the Browser: Introducing Cloudflare Browser Isolation Beta
https://blog.cloudflare.com/browser-beta
30 comments
This is how the web's re-incarnation could begin. Imagine:
• 2020: Websites are too complex. The security implications are too high. Let's run all of that code remotely, and send only draw commands to the user.
• 2025: Hey, developers, want your website to be faster and more efficient? Here's an API for performing certain operations directly on the user's machine. Don't worry, we've implemented everything in a limited and security-conscious way. Pinky promise the standard won't grow out of control over time.
• 2040: Neo-websites are too complex. Let's run all of that code remotely...
I'm not sure if I actually believe this will happen. But, consider how we got here: websites originally relied on server-side rendering, and gradually shifted to client-side rendering over time. Now, Cloudflare is offering a way to force all of that code back on to a server...
• 2020: Websites are too complex. The security implications are too high. Let's run all of that code remotely, and send only draw commands to the user.
• 2025: Hey, developers, want your website to be faster and more efficient? Here's an API for performing certain operations directly on the user's machine. Don't worry, we've implemented everything in a limited and security-conscious way. Pinky promise the standard won't grow out of control over time.
• 2040: Neo-websites are too complex. Let's run all of that code remotely...
I'm not sure if I actually believe this will happen. But, consider how we got here: websites originally relied on server-side rendering, and gradually shifted to client-side rendering over time. Now, Cloudflare is offering a way to force all of that code back on to a server...
What Cloudflare's announced is more than just DOM reconstruction, though. They sound very different to the likes of Opera Mini Turbo or Amazon Silk's Cloud Browser or Chrome's Fly Wheel...[0] In Cloudflare's case, the rendering happens on the server and only rasterization commands are sent to the clients similar to AWS NICE [1].
As a security product (if you trust Cloudflare), browser isolation sounds super tempting on-paper. As they mention in the blogspot, an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser. DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2].
So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly.
I have also been following MightyApp.com that is trying to do something similar but for consumers and with focus on productivity. It is interesting to see how this would play out. If there's a huge market for this, Google is sure to pounce on it too, and then things will get real interesting... as if AMP, WebComponents [2] and Privacy Sandbox [3] weren't already enough.
[0] https://news.ycombinator.com/item?id=19774768
[1] https://aws.amazon.com/hpc/dcv/
[2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen...
[3] https://news.ycombinator.com/item?id=24390324
[4] https://news.ycombinator.com/item?id=20767891
As a security product (if you trust Cloudflare), browser isolation sounds super tempting on-paper. As they mention in the blogspot, an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser. DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2].
So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly.
I have also been following MightyApp.com that is trying to do something similar but for consumers and with focus on productivity. It is interesting to see how this would play out. If there's a huge market for this, Google is sure to pounce on it too, and then things will get real interesting... as if AMP, WebComponents [2] and Privacy Sandbox [3] weren't already enough.
[0] https://news.ycombinator.com/item?id=19774768
[1] https://aws.amazon.com/hpc/dcv/
[2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen...
[3] https://news.ycombinator.com/item?id=24390324
[4] https://news.ycombinator.com/item?id=20767891
> an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser
Credential phishing doesn’t care where your browser is running, as I frequently have to remind IT teams who think their web proxy logs can identify 100% of victims of a phishing attack (there are almost always a few people who clicked on their phone). RBI of this type is specifically to mitigate vulnerabilities in the browser engine, the type of 0-day where you just click on the wrong thing and get owned. While these are a real threat, they are nowhere near 70%, more like less than 1% (and see my other comment about how the 70% number is just made up).
> [2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen...
Domain generation algorithms are used for malware command and control, not in the browser/phishing stage of an attack. An actual reason DNS blacklists aren’t perfect for this purpose is that attackers host malware distribution and phishing pages on legitimate services like Google Docs and Sharepoint.
Credential phishing doesn’t care where your browser is running, as I frequently have to remind IT teams who think their web proxy logs can identify 100% of victims of a phishing attack (there are almost always a few people who clicked on their phone). RBI of this type is specifically to mitigate vulnerabilities in the browser engine, the type of 0-day where you just click on the wrong thing and get owned. While these are a real threat, they are nowhere near 70%, more like less than 1% (and see my other comment about how the 70% number is just made up).
> [2] https://blogs.akamai.com/2018/01/a-death-match-of-domain-gen...
Domain generation algorithms are used for malware command and control, not in the browser/phishing stage of an attack. An actual reason DNS blacklists aren’t perfect for this purpose is that attackers host malware distribution and phishing pages on legitimate services like Google Docs and Sharepoint.
I should have been clearer: Domain generation algorithms render solutions like Google SafeBrowsing vulnerable. Sure, these are only used by botnets today, but before we know it, it'd be put to use by adware and spyware too.
DGAs aren't a solution to the "my phishing page is blocked by safebrowsing/some other blacklist" problem. You can't send someone an email with a "link" that generates URLs until one of them isn't blocked: hyperlinks aren't programmable in that sense. You can send them a link to a page that does that, sure, but that doesn't stop them from blacklisting the redirector page. How would someone running a phishing campaign actually use a DGA?
> very different to the likes of Opera Mini [...] In Cloudflare's case, the rendering happens on the server and only rasterization commands are sent to the clients.
Literally exactly what Opera Mini has done since circa 2005[0]. The main difference here is that Opera Mini progressed to the gp's "2025" scenario quite some time ago by adding limited support for events alongside OBML's rasterization commands.
[0] https://github.com/grawity/obml-parser/blob/master/obml.md
Literally exactly what Opera Mini has done since circa 2005[0]. The main difference here is that Opera Mini progressed to the gp's "2025" scenario quite some time ago by adding limited support for events alongside OBML's rasterization commands.
[0] https://github.com/grawity/obml-parser/blob/master/obml.md
> So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly.
Oh, to be clear, my post wasn't intended as a criticism of Cloudflare! Yes, Browser Isolation looks like it could be a great product.
If I sounded frustrated—which also wasn't intended—my frustration was with the industry more generally, for moving between technologies too quickly without learning from the past.
Oh, to be clear, my post wasn't intended as a criticism of Cloudflare! Yes, Browser Isolation looks like it could be a great product.
If I sounded frustrated—which also wasn't intended—my frustration was with the industry more generally, for moving between technologies too quickly without learning from the past.
> DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2].
Can you explain why not? Your reference is talking about malware C&C trying to confuse reverse engineers, not phishing attacks happening in a browser.
Can you explain why not? Your reference is talking about malware C&C trying to confuse reverse engineers, not phishing attacks happening in a browser.
> 2020: Websites are too complex. The security implications are too high. Let's run all of that code remotely, and send only draw commands to the user.
Everything old is new again.
1984: X Window System. Architecture-independent system for remote graphical user interfaces and input device capabilities. X provides the basic framework, or primitives, for building such GUI environments: drawing and moving windows on the display and interacting with a mouse, keyboard or touchscreen.
Unlike most earlier display protocols, X is specifically designed to be used over network connections rather than on an integral or attached display device. X features network transparency, which means an X program running on a computer somewhere on a network (such as the Internet) can display its user interface on an X server running on some other computer on the network. The X server is typically the provider of graphics resources and keyboard/mouse events to X clients, meaning that the X server is usually running on the computer in front of a human user, while the X client applications run anywhere on the network and communicate with the user's computer to request the rendering of graphics content and receive events from input devices including keyboards and mice.
source: https://en.wikipedia.org/wiki/X_Window_System
Everything old is new again.
1984: X Window System. Architecture-independent system for remote graphical user interfaces and input device capabilities. X provides the basic framework, or primitives, for building such GUI environments: drawing and moving windows on the display and interacting with a mouse, keyboard or touchscreen.
Unlike most earlier display protocols, X is specifically designed to be used over network connections rather than on an integral or attached display device. X features network transparency, which means an X program running on a computer somewhere on a network (such as the Internet) can display its user interface on an X server running on some other computer on the network. The X server is typically the provider of graphics resources and keyboard/mouse events to X clients, meaning that the X server is usually running on the computer in front of a human user, while the X client applications run anywhere on the network and communicate with the user's computer to request the rendering of graphics content and receive events from input devices including keyboards and mice.
source: https://en.wikipedia.org/wiki/X_Window_System
This is more limited than X, since it's designed just to speak HTML. (Though I suppose that HTML5 supports Canvas which could, potentially, be used much like X Windows... but I don't see that becoming the main way people write applications.)
Looks a lot like Mighty! https://mightyapp.com/
I've been working on a productivity oriented browser (early alpha here: https://cloudsynth.com -- sorry landing isn't complete yet). It's very obvious that those inner rendering frames can be handled by remote servers. We've managed to reduce a lot of chromes memory usage by sleeping/unmounting unused tabs transparently (where we can) and have seen a ton of performance improvement. Looking forward to swapping out the chromium rendering layer to a cloud one down the road!
The security implications are interesting too. Moving the 'sandbox' to the cloud for security purposes seems like the browsers definitely missed some of their goals.
I've been working on a productivity oriented browser (early alpha here: https://cloudsynth.com -- sorry landing isn't complete yet). It's very obvious that those inner rendering frames can be handled by remote servers. We've managed to reduce a lot of chromes memory usage by sleeping/unmounting unused tabs transparently (where we can) and have seen a ton of performance improvement. Looking forward to swapping out the chromium rendering layer to a cloud one down the road!
The security implications are interesting too. Moving the 'sandbox' to the cloud for security purposes seems like the browsers definitely missed some of their goals.
So the company that makes browsing the web with a VPN a constant annoyance wants me to use a web browser that's completely on their server because it's "more secure"?
No thanks.
No thanks.
So now that all* Websites are "behind Cloudflare", the browser can also move into Cloudflare controlled networks.
I'm sure that there is some snarky comment about giving up freedom in exchange for security somewhere in there....
*many enough for it to be annoying
I'm sure that there is some snarky comment about giving up freedom in exchange for security somewhere in there....
*many enough for it to be annoying
Outwardly Cloudflare seems like an amazing and great company.
But at this point they have more control over the web than most governments. Or maybe all of them.
So I would assume that intelligence or military cyber agencies or whatever would feel compelled to somehow hook into Cloudflare. Similar to the way I assume they have done so with other mega tech companies.
But at this point they have more control over the web than most governments. Or maybe all of them.
So I would assume that intelligence or military cyber agencies or whatever would feel compelled to somehow hook into Cloudflare. Similar to the way I assume they have done so with other mega tech companies.
I really don't like this thin client future we're heading towards.
Its VNC all the way down. Since tech trends seem to go in cycles and rediscover reasons why shifts occurred in the first place, give it another 5-10 years for people to realize providers managing everything isn't always (or even usually) in their best interest. It's only in the financial interest of those pushing this path forward. Its IBM, all over again.
On the bright side, somewhere in the swing from personal computing back to centralized computing models, I feel we hit a nice balance that made sense. Leverage the benefits and competitive marketing in personal computing when needed and aspects of centralized computing when it makes sense. Neither extreme is really all that great. Let's hope we can find that nice balance point again because where a bit too heavy on centralized computing IMHO.
On the bright side, somewhere in the swing from personal computing back to centralized computing models, I feel we hit a nice balance that made sense. Leverage the benefits and competitive marketing in personal computing when needed and aspects of centralized computing when it makes sense. Neither extreme is really all that great. Let's hope we can find that nice balance point again because where a bit too heavy on centralized computing IMHO.
They make too much money on the back and forth "next big thing" to stop doing it. Market analysts sell them on the idea that the next big thing might be a huge competitive advantage and a disruptive technology, so the "smart" companies embrace it.
There's also a lack of knowledge in present corporate management (at least in the US) generally speaking where the higher ups will reward apparent progress or activity without considering whether that activity is positive or negative long term. All that matters is that managers appear to be doing something, and when the sales people hand them a full narrative explaining how the next big thing will benefit their company, they accept it because they literally don't have to think or answer any of the hard questions to appear to be doing something useful/positive for their company.
It's sad, but I have hopes that as the old generation ages out of control of corporations that newer, smarter ones will form.
There's also a lack of knowledge in present corporate management (at least in the US) generally speaking where the higher ups will reward apparent progress or activity without considering whether that activity is positive or negative long term. All that matters is that managers appear to be doing something, and when the sales people hand them a full narrative explaining how the next big thing will benefit their company, they accept it because they literally don't have to think or answer any of the hard questions to appear to be doing something useful/positive for their company.
It's sad, but I have hopes that as the old generation ages out of control of corporations that newer, smarter ones will form.
> Zero Trust week
Hm, they'll be able to see every password, every url, every video frame... That's a lot of trust required to me. Cool tech though
Hm, they'll be able to see every password, every url, every video frame... That's a lot of trust required to me. Cool tech though
> It’s an open door to nearly every connected system on the planet, which is powerful and terrifying.
I guess fearmongering is one way to try and convince people to use your product.
I guess fearmongering is one way to try and convince people to use your product.
> [...] the only thing ever sent to the device is a package of draw commands to render the webpage
That sounds like a great solution to this problem, though I’m very curious about the details as to how that works, does anyone have resources to share?
That sounds like a great solution to this problem, though I’m very curious about the details as to how that works, does anyone have resources to share?
Some details here: https://blog.cloudflare.com/cloudflare-and-remote-browser-is...
In particular:
> A key architectural feature of the Chromium browser is its use of the Skia graphics library. Skia is a widely-used cross-platform graphics engine for Android, Google Chrome, Chrome OS, Mozilla Firefox, Firefox OS, FitbitOS, Flutter, the Electron application framework and many other products. Like Chromium, the pervasiveness of Skia ensures ongoing broad hardware and platform support.
> A key architectural feature of the Chromium browser is its use of the Skia graphics library. Skia is a widely-used cross-platform graphics engine for Android, Google Chrome, Chrome OS, Mozilla Firefox, Firefox OS, FitbitOS, Flutter, the Electron application framework and many other products. Like Chromium, the pervasiveness of Skia ensures ongoing broad hardware and platform support.
This is an example of why I think software patents are problematic.
Because Cloudflare said they are using Skia so the first thing that comes to mind is, how do you hook into Skia in order to intercept graphics commands so that you can efficiently transfer them to the remote?
And then the next thing is, what if there are already graphics on the screen before the remote session starts? Do I have to record and transmit everything that happened an hour ago? Or how do I figure out which part needs to be transferred, aside from a clear screen which obviously resets it.
So that outline is exactly what I am seeing is being patented. They do mention they are using "hierarchies" to figure out what needs to be synced. But a hierarchy is one of the most fundamental categories of data structure so that really doesn't narrow it down.
So now if you're going to hook into a graphics library and use any kind of hierarchy and then transmit it to be updated somewhere else, you have to be worried about the details of this patent? Because what I am seeing is the basic logic that stems directly from the starting point of trying to transmit the graphics at that rendering level.
Like if I go fork Skia and hack into a renderer saving the commands into some queue to be compressed and streamed, and keep track of when a new window is opened or shown (a hierarchy), it seems like I will be putting myself at risk of this patent because it is so generic.
Because Cloudflare said they are using Skia so the first thing that comes to mind is, how do you hook into Skia in order to intercept graphics commands so that you can efficiently transfer them to the remote?
And then the next thing is, what if there are already graphics on the screen before the remote session starts? Do I have to record and transmit everything that happened an hour ago? Or how do I figure out which part needs to be transferred, aside from a clear screen which obviously resets it.
So that outline is exactly what I am seeing is being patented. They do mention they are using "hierarchies" to figure out what needs to be synced. But a hierarchy is one of the most fundamental categories of data structure so that really doesn't narrow it down.
So now if you're going to hook into a graphics library and use any kind of hierarchy and then transmit it to be updated somewhere else, you have to be worried about the details of this patent? Because what I am seeing is the basic logic that stems directly from the starting point of trying to transmit the graphics at that rendering level.
Like if I go fork Skia and hack into a renderer saving the commands into some queue to be compressed and streamed, and keep track of when a new window is opened or shown (a hierarchy), it seems like I will be putting myself at risk of this patent because it is so generic.
Thanks, that exactly answered my questions! This sounds like it has huge potential, and I think Cloudflare has the maturity to pull it off, fingers crossed
The slogan "the network is the computer", prominently marked as (R), struck me, because that was Sun Microsystem's slogan. So I checked the TESS database, and things got weird. Nobody bothered to record it until Oracle did, in 2009:
http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:6jr...
but it's also marked DEAD as of 2011, without any indicator as to why. There is a live trademark, created 2018, and it does indeed belong to Cloudflare:
http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:6jr...
I suppose Oracle doesn't really see itself as taking on the Sun mantle there, but I'm surprised they'd abandon a catchy slogan. Surely they'd find some reason to use it? How long would they have to ignore it before it got marked dead; is it really just two years? Why bother to file for it in the first place?
http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:6jr...
but it's also marked DEAD as of 2011, without any indicator as to why. There is a live trademark, created 2018, and it does indeed belong to Cloudflare:
http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:6jr...
I suppose Oracle doesn't really see itself as taking on the Sun mantle there, but I'm surprised they'd abandon a catchy slogan. Surely they'd find some reason to use it? How long would they have to ignore it before it got marked dead; is it really just two years? Why bother to file for it in the first place?
Right, Oracle didn't renew the trademark, and then Cloudflare registered it.
https://blog.cloudflare.com/the-network-is-the-computer/
https://blog.cloudflare.com/the-network-is-the-computer/
What would it take to get a self-hosted version of this, preferably using FireFox on the server? How hard would it be to get plugins working as well? Would this be essentially a way of using Blink/Servo based engine on i(Pad)OS?
Check out browserless for something that's the same direction: https://www.browserless.io/
I'm imagining a slightly weirder use case where the user is on a network which replaces TLS certificates with locally-issued ones (to allow snooping, but generally not tampering), so the connection needs another layer of encryption done in the application layer.
The user could load a locally saved (and audited) page in their browser which contains the JavaScript client that connects to the self-hosted version of this Cloudflare service. The client would require the user to enter a pre-shared secret which is used to encrypt and authenticate the data being sent back and forth with the server.
The user could load a locally saved (and audited) page in their browser which contains the JavaScript client that connects to the self-hosted version of this Cloudflare service. The client would require the user to enter a pre-shared secret which is used to encrypt and authenticate the data being sent back and forth with the server.
Interesting! Are there any details on what engine the backend is using (Chromium?) How does the “send render commands” thing work? Does it continuously stream page updates as JavaScript updates the page? How’s overhead, or how much data does it save? Can I run extensions (such as a content blocker)?
From a security perspective, I’m curious as to whether the attack model includes someone who exploits the browser and does not look to escape into the host OS, instead choosing to create UXSS and the like. Is there any work being done there as well?
From a security perspective, I’m curious as to whether the attack model includes someone who exploits the browser and does not look to escape into the host OS, instead choosing to create UXSS and the like. Is there any work being done there as well?
Product Manager for Cloudflare Browser Isolation here. We're running Chromium under the hood and overhead is lower since the browser only receives visual updates and does not need to download invisible third party content.
We're working on a detailed technical blog post which will answer your questions in more detail.
We're working on a detailed technical blog post which will answer your questions in more detail.
What about the privacy considerations? Are you keeping each user profile stored permanently in the cloud or is it somehow synced client side?
All a browser is, is a tabbed UI that renders HTML. That's all the internet will ever be. Rendered HTML. Until someone creates a new engine, protocol and something other then HTTP without Webkit/Gecko/V8 there will be no "re-imagining the browser".
PR from Cloudflare wanting you to use their network instead of others, I don't buy it. Respect them a little trying to knock google down a peg but still a power-hungry company.
PR from Cloudflare wanting you to use their network instead of others, I don't buy it. Respect them a little trying to knock google down a peg but still a power-hungry company.
> It’s an open door to nearly every connected system on the planet, which is powerful and terrifying.
That is it's purpose. It's not 'terrifying'.
That is it's purpose. It's not 'terrifying'.
It's 1554 UTC as I write. There will be a live demo of this on cloudflare.tv in 6 minutes if people are curious.
This can also protect the server from attacks if it runs all sessions in isolation. All you can is click and type, no more sqli or xss that require messing with params or API. So it could be useful either way.
This is awesome but also means that latency becomes the key metric in internet / service providers.
How long until we start seeing the edge become small micro servers that live right beside metro network access points?
How long until we start seeing the edge become small micro servers that live right beside metro network access points?
This is fascinating. I assume it means Cloudflare would proxy images and other assets?
I assume it would have implications for tracking users, which would now impact not just Cloudflare customers but all web entities?
I assume it would have implications for tracking users, which would now impact not just Cloudflare customers but all web entities?
They have to do more than just proxy, or image/video/audio format parsing based attacks still exist. They probably re-encode them to simpler formats.
Sounds like their solution is approach #1 and not a new #3.
the cost is anonymity - inside their bubble you're uniqueness is guaranteed and the value of the ads just went up! hooray!
Is this like Opera Mini?
Yes, with the justification of security instead of inadequate client resources.
Not directly related to the product, but seeing more detailed, even if approximate, isochrone map of internet connectivity (similar to what that last picture is) would be really cool.
I wonder if anyone is working on an open source version of this? I’ve seen a few Firefox and chrome docker containers, but as far as I can tell they stream through vnc.
It's like fullstory[0] but backwards?
https://www.fullstory.com/
https://www.fullstory.com/
How will this affect my Cloudflare stock?
Thanks.
Thanks.
If this works for browsers, it will work for many other programs...
How about streaming a whole OS instead of just the browser?
So... it's GeForce Now for browsers?
How can they monetize this?
How can they monetize this?
Who can see your browser history?
Doesn’t Opera already do this?
This seemed like a pretty remarkable statistic to open with (where are the Office macros? If I download a shady exe or vbs with the browser and then run it, is the browser the "culprit"?), so I googled it and found that a previous Cloudflare post [1] cites this Gartner report [2] for that statistic. Unfortunately, there is no methodology to arrive at that number: it's merely listed as an assumption.
[1] https://blog.cloudflare.com/cloudflare-and-remote-browser-is...
[2] https://airlock.cdn.prismic.io/airlock/e0eca969-989e-44ad-b3...