Subject: [websec] Same Origins and email

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 12 Dec 2011 11:01:23 -0800

Hi all, long-time lurker, first-time poster.

I don't work in the web browser business so much as I do the messaging anti-abuse business.  But this stuff has gotten my attention.  Now that RFC6454 is published, I have a few questions about its possible application in my context.
My first question (probably of several): What is the origin of an HTML document when it's viewed in an HTML-aware MUA because it arrived by email?

-MSK

---

From: Adam Barth <[email-masked]>
Date: Mon, 12 Dec 2011 11:08:51 -0800

On Mon, Dec 12, 2011 at 11:01 AM, Murray S. Kucherawy <[email-masked]> wrote:
> I don’t work in the web browser business so much as I do the messaging
> anti-abuse business.  But this stuff has gotten my attention.  Now that
> RFC6454 is published, I have a few questions about its possible application
> in my context.
>
> My first question (probably of several): What is the origin of an HTML
> document when it’s viewed in an HTML-aware MUA because it arrived by email?

That depends on the MUA.  In Gmail, for example, the origin is
https://mail.google.com.  It depends on the URL the MUA assigns to the
HTML document contained in the email.

Adam

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 12 Dec 2011 11:13:27 -0800

> -----Original Message-----
> From: Adam Barth [mailto:[email-masked]]
> Sent: Monday, December 12, 2011 11:09 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [websec] Same Origins and email
> 

What about something like Outlook or alpine, where we're not talking about a web-based MUA but one that pulls from a local store?

-MSK

---

From: Yoav Nir <[email-masked]>
Date: Mon, 12 Dec 2011 21:25:20 +0200

> What about something like Outlook or alpine, where we're not talking about a web-based MUA but one that pulls from a local store?

file://localhost ?

Although I think HTML you get through the mail should not be scripted by files on your computer, so maybe each mail item should have its own origin.

---

From: Adam Barth <[email-masked]>
Date: Mon, 12 Dec 2011 11:35:11 -0800

> Although I think HTML you get through the mail should not be scripted by files on your computer, so maybe each mail item should have its own origin.

The questions you're asking don't really have universal answers.
These behaviors aren't standardized and so are likely to vary from MUA
to MUA.

Adam

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 12 Dec 2011 11:38:28 -0800

> Sent: Monday, December 12, 2011 11:35 AM
> To: Yoav Nir
> Cc: Murray S. Kucherawy; [email-masked]

I think that's why I'm asking the question.

I wonder if it would be a useful area to explore in terms of standardization since MUA-based HTML pages suffer many of the same attacks as regular browsers do.  That seems to be an attack surface that's largely unaddressed here.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 12 Dec 2011 11:42:40 -0800

> From: Yoav Nir [mailto:[email-masked]]
> Sent: Monday, December 12, 2011 11:25 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> > What about something like Outlook or alpine, where we're not talking
> > about a web-based MUA but one that pulls from a local store?
> 
> file://localhost ?
> 
> Although I think HTML you get through the mail should not be scripted
> by files on your computer, so maybe each mail item should have its own
> origin.

I was thinking maybe "mailto:" followed by whatever address is parsed from the From: field.  The problem, of course, is that it's trivially forged.

Given that I come from the messaging side and not from the browser side, I'm trying to ensure I've got the idea here: Is the idea of web origins to inform the target server of URIs in the HTML document about where the request came from, a little more generally than what Referer does, and allowing chaining, thus permitting the server servicing that URI the choice to refuse or substitute the content where it determines the referral was likely fraudulent?  Or does it allow the user agent to make more informed choices about which URIs it is willing to dereference?  Or both?

Is it possible for a server to use web origins to list other web origins allowed to reference it?  Say, could a bank's reply to an <img src> tag include a list of authorized origins?  (That might be hard to secure, but I'm talking generally here.)

Basically, if there's a way to use this stuff to help reduce the attack surface in HTML email, I'd love to put it to use, and that's what I'm (pardon the pun) fishing around for here.

Thanks,
-MSK

---

From: Adam Barth <[email-masked]>
Date: Mon, 12 Dec 2011 11:52:47 -0800

> I wonder if it would be a useful area to explore in terms of standardization since MUA-based HTML pages suffer many of the same attacks as regular browsers do.  That seems to be an attack surface t…

I really have an opinion on that topic.  If you'd like to move in that
direction, I'd recommend talking with implementors of MUAs to see if
they'd be interested in implementing such a standard.

Adam

---

From: Adam Barth <[email-masked]>
Date: Mon, 12 Dec 2011 13:06:10 -0800

On Mon, Dec 12, 2011 at 11:52 AM, Adam Barth <[email-masked]> wrote:
> I

^^ don't :)

> really have an opinion on that topic.  If you'd like to move in that