Network services giant Cloudflare wants to host your web browser in the cloud so it can send you only safe content.
On Thursday, the biz invited customers to sign up for the beta release of its Browser Isolation service, a third component in its evolving Cloudflare for Teams offering that came from S2 Systems, a Kirkland, Washington-based startup acquired earlier this year.
Browser isolation generally involves running a headless web browser – the browser foundation without its graphic interface – on a remote server, now commonly referred to as "the cloud," and then buffering its visual output in some kind of format to send to software on the user's computer to display. Scrubbing the web content of bad stuff before it's rendered is a possibility, too, and that's what Cloudflare's Browser Isolation appears to do.
There are also client-side variations like Apozy's Native Browser Isolation, and HP-acquired Bromium (now HP Sure Click), which relies on running browser tasks inside a hardware-isolated micro virtual machine.
Cloudflare floats cloud grand unification theory based on zero-trust access and securityREAD MORE
Browser quarantine regimes have won corporate fans as a way to mitigate web-based security threats, and also to manage how workers interact with the unwholesome web. Think of web content as a package containing a bomb; if it explodes, you'll wish you opened it in a concrete, reinforced bunker so that adjacent bunkers and buildings aren't taken out. That's browser isolation: containing any malicious stuff that spills into and out of the browser on your employees' PCs.
Companies playing in the browser isolation market like Authentic8, Broadcom (Symantec), Menlo Security, and Webgap, among others, generally point to business-justifying stats compiled by consultancies.
Cloudflare, for instance, cites Gartner's 2018 claim that web browsers are the source of 70 per cent of endpoint compromises. The IT research firm, declaring the public internet "a cesspool of attacks," also projected that by 2022, 25 per cent of enterprises will adopt browser isolation technology for high-risk users and specific use-cases, up from one per cent in 2017.
Tim Obezuk, product manager for Cloudflare Browser Isolation, contends that Cloudflare Browser Isolation has an advantage over other approaches that rely on pixel pushing or DOM reconstruction. The former involves streaming rendered screen pixels to a remote user (slow) or loading pages remotely, checking them, then repacking and relaying them to a remote client (misses threats and prone to errors).
"Instead of streaming pixels to the user, Cloudflare Browser Isolation sends the final output of a browser’s web page rendering," said Obezuk in a blog post. "The approach means that the only thing ever sent to the device is a package of draw commands to render the webpage, which also makes Cloudflare Browser Isolation compatible with any HTML5 compliant browser."
Cloudflare Browser Isolation relies on Network Vector Rendering (NVR) technology from its S2 Systems acquisition. This intercepts the draw commands directed at the the remote Chromium browser's Skia graphics rendering layer, then encodes, compressed, and encrypts them in a highly compact form before sending them to the remote client browser – which can be any HTML5-compliant browser (e.g. Chrome, Edge, Firefox, Safari).
Using an NVR WebAssembly library with an embedded Skia library that has been pushed to the local web browser, the transmitted draw commands can be unpacked, decrypted, and replayed with speed that approaches native device code.
It's an approach that looks like it could work well given Cloudflare's edge-centric network – with more than 200 data centers around the globe, latency between the user and the Cloudflare Browser Isolation host is likely to be less than it would be for a service operating under a more centralized network architecture.
We asked Cloudflare if browser add-ons will fit into its isolation approach, and a spokesperson told us:
Our intent is to support browser extensions isolated in the remote browser. This will open the possibility to control what extensions can be used and remove malicious ones. Remote browsing offers a lot more control than managing on a locally installed one as we can upgrade and patch a user’s browser even if their computer is off.
If hosted browsers of this sort catch on, it may be time to stop referring to them as "user-agents" and call them something more accurate like "admin-agents." ?