Google looks to kill man in the middle attacks

Chromium updates will address man in the middle attacks, Google announces.

Chrome

Google Chrome researchers have announced Chromium updates to tackle man in the middle attacks, focusing on "mixed scripting" vulnerabilities.

These vulnerabilities occur when a page served over HTTPS loads a script, CSS or plug-in resource over HTTP.

"A man-in-the-middle attacker (such as someone on the same wireless network) can typically intercept the HTTP resource load and gain full access to the website loading the resource. It's often as bad as if the web page hadn't used HTTPS at all," read a blog post from Chris Evans and Tom Sepez - members of the Google Chrome Security Team.

They announced blocking mixed scripting conditions by default would be trialled in the first Chromium 14 canary release, meaning it could appear in the Google Chrome browser in future releases.

An infobar showing when a script is being blocked will also be added.

"As a user, you can choose to reload the website without the block applied. Ideally, in the longer term, the infobar will not have the option for the user to bypass it," the Google researchers said.

"Our experience shows that some subset of users will attempt to click through' even the scariest of warnings - despite the hazards that can follow."

Tracking your identity

In another security play, Google introduced a new tool on Wednesday to help users monitor their identity on the internet.

Called Me on the Web,' the feature can be found within Google Dashboard beneath the account details link.

Me on the Web offers recommendations of notifications for mentions of users' names or email addresses in websites and news stories.

"Me on the Web also provides links to resources offering information on how to control what third-party information is posted about you on the web," said Andreas Tuerk, Google product manager, in a blog post.

"These include common tips like reaching out to the webmaster of a site to ask for the content to be taken down, or publishing additional information on your own to help make less relevant websites appear farther down in search results."

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

Data breach exposes widespread fake reviews on Amazon
data breaches

Data breach exposes widespread fake reviews on Amazon

7 May 2021
TsuNAME vulnerability could enable DDoS attacks on major DNS servers
distributed denial of service (DDOS)

TsuNAME vulnerability could enable DDoS attacks on major DNS servers

7 May 2021
What are SSH keys?
cyber security

What are SSH keys?

7 May 2021
Google’s about to push everyone into two-factor authentication
Security

Google’s about to push everyone into two-factor authentication

6 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
Qualcomm modem flaw puts millions of Android users at risk
Google Android

Qualcomm modem flaw puts millions of Android users at risk

6 May 2021