Reply to thread

Message

<blockquote data-quote="Lenny_Fox" data-source="post: 860022" data-attributes="member: 82776">To deal with Meltdown and Spectre like attacks new cross origin API and data exchance protections are introduces by W3C to implement across browsers (see for instance&nbsp; <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)" target="_blank">CORP</a> and&nbsp; <a href="https://www.w3.org/TR/cors/" target="_blank">CORS</a>).Probably these newer cross site protections don&#039;t combine well with the Windows OS enforced AppContainer rights restrictions. As a result Google is introducing the&nbsp; new Multi-origin trusted web activities (<a href="https://developers.google.com/web/updates/2020/01/twa-multi-origin" target="_blank">TWA</a>). Keep an eye on the flags, you will see more cross-origin or CORP or CORS experiments in future related to these new cross-site-origin mitigation policies.After AppContainer for renderer was removed a new Site Permission (allow file edit access) was introduced. Microsoft Edge chromium does not have this Site Permission, but has this file access mitigation combined with ask save-as for downloads (small difference with Edge and Chrome, when this setting is enabled, Edge also blocks save-as web-pages and Chrome does not).AppContainer restricted file access and had some capabilities (e.g. internet access) which could be set or limited on demand. It looks that the new File Edit site permission has replaced the most important access right restriction of AppContainer.The future is bright in terms of security <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" /> (privacy is a different ball game <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />)</blockquote>

[QUOTE="Lenny_Fox, post: 860022, member: 82776"] To deal with Meltdown and Spectre like attacks new cross origin API and data exchance protections are introduces by W3C to implement across browsers (see for instance [URL='https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)']CORP[/URL] and [URL='https://www.w3.org/TR/cors/']CORS[/URL]). Probably these newer cross site protections don't combine well with the Windows OS enforced AppContainer rights restrictions. As a result Google is introducing the new Multi-origin trusted web activities ([URL='https://developers.google.com/web/updates/2020/01/twa-multi-origin']TWA[/URL]). Keep an eye on the flags, you will see more cross-origin or CORP or CORS experiments in future related to these new cross-site-origin mitigation policies. After AppContainer for renderer was removed a new Site Permission (allow file edit access) was introduced. Microsoft Edge chromium does not have this Site Permission, but has this file access mitigation combined with ask save-as for downloads (small difference with Edge and Chrome, when this setting is enabled, Edge also blocks save-as web-pages and Chrome does not). AppContainer restricted file access and had some capabilities (e.g. internet access) which could be set or limited on demand. It looks that the new File Edit site permission has replaced the most important access right restriction of AppContainer. The future is bright in terms of security ;) (privacy is a different ball game :unsure:) [/QUOTE]

Verification