• Post category:Cloud
  • Post comments:0 Comments
  • Post author:
  • Post published:07/08/2021
  • Post last modified:07/08/2021

The Microsoft Browser Vulnerability Research team is working on a Super Duper Secure Mode for the Edge web browser. Yes, really.

“The VR is experimenting with a new feature that challenges some conventional assumptions held by many in the browser community,” Microsoft’s Johnathan Norman explains. “Our hope is to build something that changes the modern exploit landscape and significantly raises the cost of exploitation for attackers. Mitigations have a long history of being bypassed, so we are seeking feedback from the community to build something of lasting value.”

My favorite part of this post is that Norman admits that the name of this mode is “slightly provocative” because they want to have fun with this and it’s too early for an official name. Which Microsoft corporate will probably screw up.

Anyway, as Norman explains, most Chromium-based web browser exploits target Google’s V8 JavaScript rendering engine because “JavaScript engine bugs … provide powerful exploit primitives, there is a steady stream of bugs, and exploitation of these bugs often follows a straightforward template.” (This is true of non-Chromium browsers too.) JavaScript engines are a remarkably difficult security challenge for browsers, he adds.

To combat this problem, Edge’s proposed Super Duper Secure Mode would disable the JavaScript engine’s Just-In-Time (JIT) compilation technology, which speeds up JavaScript workloads dramatically and makes this scripting language roughly as performant as native C++ code. The reason? Obtaining this level of performance requires a lot of complexity, which provides hackers with lots of places to pry for vulnerabilities.

“What if we simply disabled the JIT?” he asks, rhetorically. “This reduction of attack surface has potential to significantly improve user security; it would remove roughly half of the V8 bugs that must be fixed. For users, this means less frequent security updates and fewer emergency patches required.”

That’s fantastic, but it seems like this change would also lead to a dramatically slower Microsoft Edge. But that’s not necessarily true: Norman says that “users with JIT disabled rarely notice a difference in their daily browsing” in testing. The performance degradation across multiple tasks ranged from no change at all to 16.9 percent, along with an average 11 percent increase in power consumption and a 2.3 percent increase in memory usage.

In a nod to my disdain for benchmark tests, this change impacts the popular Speedometer 2.0 benchmark by as high as 58 percent. “However, often users do not notice this impact because this benchmark tells only part of a larger performance story,” he says. Yes. That’s true of all benchmarks.

Norman says that Microsoft plans to investigate its Super Duper Secure Mode experiment over the next few months and determine whether making it available publicly in Edge is beneficial enough. And he admits that his team’s “tongue-in-cheek” name will likely have to change because, well, Microsoft.

But here’s the best bit: If you’re interested in testing Super Duper Secure Mode, you can do so now with Edge Canary, Dev, and Beta: Just enable the Super Duper Secure Mode in edge://flags. And then send Microsoft your feedback using the Feedback menu in Edge.

Tagged with Security

Leave a Reply