My name is Lul Tesfima, Senior Policy Advisor with the Center on Education and Labor here at New America, and I'm thrilled to be joined by Mayor Kim Norton. Mayor Norton is the Mayor of Rochester, Minnesota. She has held this position since January 2019, and before becoming the city's first female mayor, she has a long history of public service and leadership, including 10 years in the Minnesota State Legislature and 10 years on the Rochester Public School Board. Really excited to be in conversation with you today, Mayor Norton, because I know you, just like so many other city leaders, have been focused on how to advance policies and practices that create better jobs for community residents who have really struggled during the pandemic, but even before. And that's for good reason. We know that economic mobility in this country has been declining, stagnant wages and inflation has made it harder for a lot of residents to really just make ends meet, particularly low income individuals in communities of color. And so I want to hear a little bit from you today about what you're doing to make sure that people have access to good jobs and are able to advance economically. But first, could you just tell us a little bit about your city and your residents? Sure. So I'm the Mayor of Rochester, Minnesota, which is in the Upper Midwest. We have about 124,000 people in our community and we host the state's largest employer, which is Mayo Clinic. So we are primarily focused on the world of healthcare. We have, we're about 73% white. We have an average median income because we're a healthcare community that's actually quite high. It's around $76,000 for an individual or $98,000 for a family on average is the median. I'm sorry, the median. We have a 6% poverty rate. I've seen it posted as high as 9%, so relatively low poverty. But if you look at our black population in particular, what you will find is the average median income is closer to 44,000 and 40% of our black population lives in poverty. So we have great disparities in our community and we also know that those disparities were exacerbated by the pandemic and that women and BIPOC women in particular were the last and are still many of them at home and not back in the workforce. So that was kind of the impetus to for what we've done and what we'll talk about. I would say one other thing that you might want to know about our community is we have something called the Destination Medical Center Initiative, which was a $6 billion initiative that Mayo Clinic and private Mayo Clinic, it was their idea I guess and they got legislative support for $585 million of infrastructure in order to accommodate a $6 billion economic development and growth in our community. So we were already, prior to the pandemic, starting this infrastructure replacement and upgrades in our city center and a little beyond that between the two Mayo Clinic campuses, the hospital and the downtown area. So we were already poised to have growth and development in the construction. We needed construction workers. We knew that about 2,700 a year for the next 10 plus years and we're also growing community. Yeah, so thank you for sharing that background. It was really interesting to hear that you've been thinking about the need to improve your infrastructure and Mary Alice talked a little bit about some of the federal investments that have been made and will flow down to cities and states to support infrastructure development. So I know it'll be an even bigger priority. Could you talk a little bit about what pathways to infrastructure jobs look like in your community? Well, as I said, we have a great need for those jobs, but what we were finding is that we have 16,000 BIPOC women that live in our community and less than 1% of them were working in this area. And so we determined when we had the opportunity to apply for the Global Mayors Challenge Grant that Bloomberg Philanthropies kind of put out there for mayors to apply. We decided that let's focus on the people that needed upward mobility that had been impacted the worst during the pandemic and provide them opportunities in an area we knew that we had a need for and that was growing and that provided really good careers because when you have a guaranteed investment for 10 or 20 years in your community because of this Destination Medical Center initiative, that's not a job, that's a career. That's 20 years. It was a 20 year plan. We're in year 10 right now. So we know that we had an opportunity for people and what we did then was spend a year researching, looking at quantitative and qualitative data of our community and tried to determine what were the needs, how are we going to get women into that line of work because it did, we have health care, of course, there's a lot of health care jobs and so Mayo Clinic and our community are already working on pathways for health care. We have a program called Bridges to Health Care that's quite successful and we looked at that program and tried replicating it to an extent but we knew that we didn't have the answers. Why weren't women going into construction and built environment careers? So we brought them to the table and I think that's really the story that's worth telling about the work that we're doing is it wasn't someone in our administration or in the construction industry getting a great idea and telling us, here's what you need to do. I was bringing women in our community to the table to say, what do you need, what's missing? And we learned a lot in that eight months to a year of investigation, talking to women, we learned a lot. And then they got to be part of the team to devise our plan moving forward. And this co-design process that you ended up implementing, it was something that you had previously used in the city, could you talk a little bit more about how you had previously used it and how you thought it fitting to apply in a policy context? Absolutely. So we're committed to the democratic process, of course, which involves getting the community, all members of the community, not just those with the loudest voices or the most ability to reach us. We decided as a community doing this design work on our roads and our city center, we decided to use something called co-design. So we found members of various communities, underrepresented communities, including disability and others at various income levels, brought them to the table and did some training and then sent them back to their communities to talk, had a series of questions, had information gathering, if you will. And then they would bring that back to the table. So it's an exchange back and forth that's having a small cohort of individuals who, when they did their work, were impacting hundreds and hundreds of more individuals that we probably didn't have the time or even place to get together to have a good discussion. So we had been doing that for our road work and our plaza design and we decided to bring it back to the community in a different way in that setting policy. So we brought them to the table on this project and also for our Sustainable Resiliency Task Force and utilized the co-design process there and I did provide, we have one booklet which can be passed around here so you can look at it after we've done this work now for the last couple of years. We do have a booklet but we also have it and I believe you have it online so you can get an electronic copy of what we've done and it has some case studies in there that talks about the process but it was absolutely fabulous. When we started it and we brought the women in to talk with our construction workers and an architect and a union laborer and others, we brought them in. It was like dead silence. It was quiet. It was really uncomfortable. By the end of their eight months or so of working together it was dynamic and they shared information and I should also mention we paid these women to come to the table because the men are already there because they're working and employed and they were getting paid but we decided we're using them as experts of their own experience and helping us design our community they deserve to be paid to so we did and have continued to pay these co-designers and kind of ironically but wonderfully at least three of them that I know of our current city DEI director one of our Destination Medical Center a new staff member there and someone in the built environment now were co-designers that got hired because people can see the competence they had the opportunity to work one on one with them so it's been really exciting in fact one of our young women in the built environment called and told us she's just put a down payment on a house for she and her children so that was really exciting even before we have really rolled out the whole plan to see our co-designers benefiting from the experience I think that's so wonderful and it really speaks to the importance of partnerships which are going to be absolutely critical to make sure that these investments in infrastructure across the country are really benefiting the people who need it absolutely now we typically when we talk about infrastructure we are referring to roads and bridges hard infrastructure but there is an extensive list of other critical forms of infrastructure that are really necessary in communities and I'm hoping you could talk a little bit about some of those other elements of infrastructure that have been really important to your city and your residents well I would say throughout this process of having our women our co-designers at the table as we learned a lot about their needs that maybe and it is infrastructure but there are needs and barriers which you know we can talk about but some of the culture clashes we have a lot of a pretty robust immigrant population in town they have special needs that aren't being addressed by our community let alone the workforce issues but child care the infrastructure for child care is just absolutely huge for these families and we talked back in the the green room that we really do need to look at culturally competent and culturally specific child care for these women who want to get into the workforce but really want to make sure that their children are cared for in a manner and a method that is comfortable and familiar to them and their children and so that's one example of an infrastructure that has to be in place in order for women to get to work and to be able to be successful on their jobs flexibility in careers is another that we heard a lot about sometimes our our structures are historic and we continue to do them that way because we've always done them that way and we we hear from the industries we need employees and yet they're not looking at themselves and saying what might we change is that ours or is there some sort of flexibility that we could put in our role as an employer that would then be more welcoming and convenient to people in order to get new workers on the job and so you know we're having to work with those kinds of issues as well and I don't know if you have others that you're interested in that I yeah well no that you know that's something that we've heard in conversations with other city leaders and community leaders and and workers themselves just the importance of addressing some of the overall supports and need for child care in order to really be present and participate in the in the workforce what do you see as the role of cities and supporting those needs that are pretty much universal it's been interesting because what I often hear from people who push back is it's all market driven cities shouldn't be involved in business in the market and yet we know that the market has not been successful for everyone and something has to intervene to change that that pathway that historic pathway that has been successful for some but not for everyone so for us the global mayor's challenge grant was an opportunity and believe me it was a it was a stretch to think we could compete against you know mayors and cities all over the world but we were we were we felt passionate about the the work that we were doing and apparently they felt that the work we're doing and who knew the infrastructure bill and the inflation reduction act would pass when we were working on this because our work now is more relevant than we anticipated because we were looking at it really from a very selfish perspective we had five hundred eighty five million dollars of state funds to to fix our infrastructure which you know we're all suffering from aging infrastructure across the country so we were looking at it very selfishly but now we have we are laying the groundwork I hope for a replicable process and procedure that other cities can do to see that a city with a little bit of help and support and frankly if we get this moving my hope is that the systems will change whether it be the education systems the training systems the child care systems there's a lot of systems in place and and the workforce will change in order to accommodate a new and important and necessary workforce in the future so we're laying the groundwork but it isn't the cities can't do it all and we do need partners you mentioned that our nonprofits are huge partners grants philanthropy is also something that is going to have to help us along I think yeah thank you for that Mayor Norton I know we have an audience in the room and an audience online I want to pause to see if there are any questions a quiet audience thank you Bridget if you'd like to do you need to repeat it the question yeah so the the question was could you talk a little bit more about child care since that was identified as a key barrier to share a little bit more about what your team is doing yeah we're just getting started on this part we spent a year doing the work um then the grant you know the winners were announced and we were one of three in the country and we're thrilled and now we're hiring and laying the groundwork to move ahead um one of the things that not just in child care but also beyond that that's really important to me is not just getting people in a job in the built environment that's important yes but it's getting those same women able to be entrepreneurs and open their own businesses right so we're starting with one and I'm and I'm and that's what the grant was for we also won $750,000 in federal earmarks for this project which I hope we can you know layer on the top of that for these entrepreneur jobs and frankly daycare is an entrepreneur job particularly if we're talking you know culturally sensitive culturally specific daycare and then the National League of Cities an organization that most cities belong to um has a couple programs uh communities of opportunity cities of opportunity of which we're involved in and inclusive entrepreneurship and so we're having a child we're doing um informal entrepreneurship track um an ecosystem accelerator track and we didn't get into the early childhood track but we're going to mirror it and do it anyway because we feel it is so important um and we and I'm not sure how exactly we're still working with National League of Cities to make it work and they're committed to helping us because we have to build on the grant it's not the grant itself that's going to solve all the problems we have to build on that to build this entrepreneurship network in so that's kind of how we're looking at it as entrepreneur as as entrepreneurs as business owners as we move ahead and I can just mention um a couple other things just that that we learned in that that phase of of meeting with and talking with our community and through that co-design process women prefer to work in cohorts they don't want to be the only one on the work site it's very uncomfortable if there's a problem on the work site they don't want to be the one raising their hand and saying there's a problem because it might affect their ability to keep and maintain that job so one of the things that we're providing um is navigators on site both for the business as well as for the women so as we move through this pilot project or it's going to be more than a pilot but as we move through the project the starting phase will have navigators for the women that can be on the work site and help be their voice and we're making we're not making our businesses have agreed to go through um a diversity assessment prior to bringing the women on and they're going to have a navigator and the two of those navigators will work together you know paying attention to the needs of each of their group that they represent and coming to solutions that are workable for both so that's another component I thought might be worth mentioning and another one was um the familial influence when we have a pretty robust group of immigrant families in our town with cultural barriers that I that I wasn't aware of it's like you have to go into this type of field it has to be a helping caring field and we need to find ways to not just if the individual the the young lady I spoke with was telling me well I may want to do that but if it isn't acceptable or my family doesn't understand that job or think it's appropriate for me or a woman they're not going to pay for it right so we're going to remove that barrier um of cost but we also have to know we have to work with the families it's not just that student or that young woman it's working with that woman and her whole family throughout the process so those are just a couple other examples of things of these barriers that I don't think some of the traditional methods being used right now are necessarily addressing that came out in our our analysis now it's great feedback to receive I know we have another question hi my name is Amy Cardell I'm with CompTIA the Computer Trade Industry Association and Mayor Norton I really appreciate your co-design approach it was very interesting for us to hear those insights and I think many of them affect so many of the jobs in the tech sector that we're looking at I was curious as well about the co-design of the community or your research that showed what sectors the jobs will be in because obviously you talked about construction and you're a healthcare hub but you know my secret able plan is of course technology jobs so I'd love to hear what you found there too my community as I mentioned before is definitely healthcare focused we also have been home to the largest IBM manufacturing plant which is now changed over time so it's not manufacturing any longer so we have a lot of technology workers in town and we're trying to work that in I guess I would say we've just had an analysis done of the needs of our city and also are looking at what jobs are going to be out not outsourced work from home in the future and so we're trying to look at our city center all the money we're spending on building that out and saying do we need to make changes based on what we're learning during the pandemic and and thinking about the future of city centers and so we know we're going to need more than just construction workers and that that is the area that we're focused on but we think the co-design method can be used in other areas as well and we think just like we used it for physical infrastructure now we're using it for policy infrastructure for our communities and I think it can I think it can be replicated into any industry frankly but it is purposeful it takes time and you have to I think if you're gonna this is the message we heard we could ask time and time again this is our community our women saying we could ask time and time again for our opinion and then we nothing happens right so people don't want to be asked and then nothing happens so again they are part of the design team not just uh we want your opinion and then goodbye right I think that's part of what makes this so important but I think it can be transferred and and I hope people will will try it and as I said we just put together the framework in this booklet or online booklet so I don't really have a hard answer yet because we're just at the beginning but I do think it's transferable but it's really helpful to hear kind of your initial thinking even early on in this process and then we have another question yeah Norton thanks so much for being here Shailen Jotishi from New America my question is about how we can go about funding these kinds of efforts at other cities you know it's it's really great that you know your community won the grant and you mentioned partnerships with non-profits and philanthropies but you also mentioned you know employers and getting them to look inward and think about what they can do and I'm curious if you have advice for mayors and city leaders and other communities and regions who might not have the foundations or the philanthropies but do have employers as partners have you seen anything that works well to incentivize employer financial contributions to these kinds of uh efforts on co-design and sort of how do you fund that as a city leader and as the mayor thank you so much thank you for the question I would say we were fortunate and that we had the destination medical center initiative out there which did give us money not for some for people but mostly for the infrastructure so and we had a model in place to do that so um I would say the other piece and we talked about this in the back room is that at the start of the pandemic we needed to make sure everyone was taken care of in our community so we met as as part of our nonprofit consortium the city jumped in the county jumped in and the chamber frankly came to those meetings as well the chamber of commerce and we we met every other week with all the nonprofits in our community online and that that continued throughout the whole pandemic and what was fascinating and it wasn't so much about an infrastructure change that this may come to bear but I think this idea of building that really strong partnership with all of us every one of them but we would have 60 or 70 or 80 people from time to time the major we have a lot of nonprofits in town but the major nonprofits would come and we could talk to each other about where we saw a whole who's going to help this group or we've identified this problem does anyone out there have the capacity to address it and so on these regular meetings these regular calls we were able to say and someone would say yeah I can help feed that group or I can help provide housing or get a job or you know so because we were all working together I would say the challenge has been keeping that going post-pandemic we do meet monthly but I think it's trickled off a little bit and I think you know here moving ahead into the next year we need to make sure that that stays strong we were fortunate that during the pandemic we had that and we need to continue to do it and I do think we have the course Mayo Clinic is a major employer they know that having a strong community and a strong economy helps them right other businesses know that too and we were so fortunate we had a couple an architect we had a construction company we had the unions who identified their own needs and said we're going to come to the table and help you because it helps us too right so I think yes I think absolutely getting businesses on board because it's helping them if we if we have a if we have a project and there's nobody that can provide the work you know they're in trouble we're in trouble yeah so it takes us all yeah really really identifying the the common needs that you all have to identify some common solutions together I think that's right and we've done that in health care in our community in the past of course because of Mayo Clinic the bridges to health care programs have been highly successful they target new immigrants and refugees who come to town help with language training get them through training and again they provide one-on-one supports so if you're struggling in school there's always someone right there who knows and we're going to be doing that as well as we get people into the training whether it be a union training or whether it be rctcr community college or they want to be an architect and go to a four-year university because we know we need architects too there will be someone there that will be there to to help support them if they need it okay we have another question hi hello I have just a quick question I actually builds on the end of your response there I'm wondering how much of this work is being targeted to young adults and in in particular getting young adults into some of these fields that you've mentioned in infrastructure here at new america we lead a national working group on youth apprenticeship and work-based learning in the skilled trades and we hear from our from some folks from minnesota based and from other partners around the country that it can be very difficult to recruit young people into these roles both because they may not necessarily know about them or know how to access them but there are also regulations and sort of insurance barriers to hiring younger people before they graduate from high school so I'd love to hear any strategies that you all have used to try to target younger learners whether it's specifically through this infrastructure activity or you mentioned earlier in your remarks just trying to reduce cost barriers and access barriers to post-secondary training generally for for young adults yes all of that we did learn in the interview process early on about we did interviews and I actually have the sheet here the questions we asked people most people had not even heard the names of probably two thirds three quarters of the trades and the jobs in the industry they didn't know what they were I said well how can I you know how can anyone aspire to something where they don't even know what the term means it's not a job they don't even know what it is so we identified that early on so it's so we're looking at it at several levels the industry level and getting people in that may have gone through the training because we've been trying to do a little training before but working through the k-12 system with career awareness some hands-on experiences we do have a program a c-tech program in our community so our high school students can come out and do some technical careers some training and some of those are like welding some of the skills that we need in the community so we have that for high school and we need to grow that and also outside of the school setting and that's an area that's really fascinating the Girl Scouts in the in the state of Minnesota do a wonderful I went this summer was up in the Twin Cities it's called power girls and so it's a week-long camp where they stay up in the Twin Cities and it was for southern Minnesota so I went up and experienced it and there was a day on electricity and there was a day on carpentry and there was a day and each day was a different trade and the girl spent the entire day building something computer cables that they could take home and use you know for their computer and ethernet cables and so it was hands-on what we learned however and again the best idea right but nobody bothered to ask some of the families what we found out in a in a different setting in our community is that for many families particularly immigrant families overnight aren't a thing they don't do overnight not to their neighbors not to their friends and certainly not to a camp up in the Twin Cities and so the camp was primarily for white children not a hundred percent but you know and that's that's great because we want all women in construction so that's fine but how are we reaching our our BIPOC community we're not so we are actually going to work with the Girl Scouts of this summer in Rochester at a day camp that will be similar but it will be a day camp for kids in the region who can come in and experience the same thing and go home at night so we can remove that barrier of overnights that literally none of us were aware it was a thing so it's it's that kind of learning and again if you bring people with lived experience and bring people from different cultures to the table they can tell you that and you don't have to wait 10 years to find out you know that the kids in the class that didn't come to my daughter's overnight for her birthday were because it's not it's culturally uncomfortable and I didn't know that right I have one one final question for you and this has been such a really great discussion but our conversation is going to be followed by a discussion between the deputy secretary of labor deputy secretary of transportation we will also hear from someone from the department of commerce three agencies that are a part of the broader federal effort to make sure that these historic investments in infrastructure projects are also leading to really wonderful infrastructure jobs for communities particularly marginalized communities and so I'd love to hear from you your reflections on the role that the federal government should play but also state governments and in making sure that we are effectively leveraging these these resources that we can expect over the next several years it really is an exciting time we're working on this and and as I said kind of surprise infrastructure and there's money available for all of us and I'm busy trying to get infrastructure dollars into my communities you know which means more of a workforce but it's it's just absolutely vital that we do this and it's it's not just vital that we have an influx of money for infrastructure or for electrification or for you know energy that energy transition yes that's all wonderful but this is an opportunity to make sure that every single person in your community gets to benefit from that and not the same people that have always historically benefited we but we have to do the work in the cities and in our communities and in our jobs and in our nonprofits to make sure that we can provide that upward mobility to everybody in this country we haven't had this kind of opportunity that I'm aware of for a long long time maybe ever so my hope is that the work that we're doing can be replicable that other communities can be you know see it as a model that they might want to do in order to take advantage of the wonderful infrastructure that is so vital at a time in our country's infrastructure is aging right and we all are going to need to do that work and this will allow us to do it and let everybody in our community benefit yeah yeah thank you are there existing structures within your state that you're tapping into or that could be you know leveraged to really facilitate the sort of coordination that's necessary not just at the city level but at the regional level and then across the state we're building those out we've started having meetings with some of the for instance our state union boards after that after we were identified as one of the you know 15 global marriage challenge cities we made those calls and we've had some of those initial meetings to say how can we all work together and make this not just about Rochester but but changing the way we do things to benefit people all over and I would say there have been efforts underway and the one point that I made is well if less than one percent of the construction workers in my community are our BIPOC women then we've got a lot more work to do so it's not to say that anybody wasn't the best efforts and intense weren't there but it wasn't working and so we're hoping that through our efforts and the the co-design model that we can start making sure that the efforts that people are making pay off for the people that we're trying to provide upward mobility to at this extraordinary time in our history. Thank you Mayor Norton please join me in thanking Mayor Norton.


The COVID-19 pandemic has created a global health and economic crisis. The disruption to business is unprecedented. While many businesses have been able to continue to operate, the adjustments that have been necessary in order to quarantine, social distance, minimize health risks, pivot and or innovate business practices have been enormous. As we begin to think about post-quarantine life, the varied experiences of employees in relative isolation ranging from inconvenience to being traumatized must be the starting point to plan work reentry. Getting back to business safely, Dr. Barbara J. Brown, a licensed clinical psychologist in Washington D.C. will give us practical advice for employers and employees. Thank you for joining Sister Parr and welcome back, Dr. Barbara Brown. Thank you very much for having me back. Well, you know, you, we talked in the last segment on conscious self-care about the reentry of work and now we're getting closer to that time. I know that Honolulu and I think D.C., we're scheduled to go back. The nation is going to go back June 8th. Well, that's the latest date that they're giving it. That's the latest date. Well, Dr. Brown, as we pivot towards reopening our doors and turning on the lights, many businesses are asking what and how to prepare. What are some guidelines you can share with us? Well, I think, you know, there are a lot of practical matters that need to be considered, especially around safety and a lot of people are taking care of that. I think we as psychologists and mental health professionals have been focused on the psychology of it in terms of getting people back to work. People are still fearful. There's been a lot of isolation, a lot of distancing from people and from workplace, even though a lot of people are working.  We have to do things differently in order to feel safe and comfortable. And there is the new normal. Yeah, right, the new normal, whatever that may be. I know I guess it's going back to work with our mask on and ensuring that we wipe down everything. But the push to make money comes at a cost to our health. What's your message to people? I think that one of the reasons that we looked at the process of psychological re-entry is because of what is happening in society.  And I think trying to keep both in mind and in perspective is very important. It's almost like we're living in this dystopian society where the haves and the have-nots are getting more and more divided and we have to get back to our humanity in, you know, while we're trying to go back to work. Well, let's talk about the three steps to re-enter workforce. That is something that I know managers and supervisors and employers and employees are one to concentrate on. So walk us through the three steps. Sure. So, yes, we advocate best practice as a three-step process where you're connecting with individuals and really showing compassionate leadership and really connecting with your employees to find out what have they been going through, what are their thoughts about coming back to work, how engaged or disengaged are they, and then going through the process of wanting them to join in a more cohesive way by forming work groups, task force work groups, where they can have a say and input into how they come back to work, and then finally being part of a larger community and getting the same messages through town hall meetings. So that's the three-step process, but I can go into each one a little bit more if you'd like. Well, especially the three steps to enter the workplace, the individual employee meetings you were referring to, now how should that take place? Is that, well, just give us a chart on that. Sure. It's best done as much as possible before people, during this quarantine period, while people are still in quarantine, reaching out, managers and supervisors, reaching out to individuals, setting up meetings to check in with them, again, see how they're doing, see how they're doing self-care. If they're working, then how productive are they having any difficulties, how you can help them during this period of time, what they anticipate they will need going back. Again, people are in different circumstances. Some people have been in isolation totally by themselves, other people have their children around them, and sometimes they're elders as well, and they're really quite busy being, you know, mom, teacher, you know, worker, and it's very taxing on them. And for other people who aren't as fortunate and are not working, they've been furloughed, and a lot of them have been hopefully temporarily furloughed, but they may be having hardship financially. Yeah, this is just, it's challenging because you have to decide, I need to work, we all need to work, we all need some form of income coming in, and then we need our health as well. I mean, you can't work if you're not healthy. So how are we going to talk to the managers and supervisors, how are they going to wrap their head around coming back? How does the managers and the supervisors and company owners make the employee feel safe? I think that, again, the notion of compassionate leadership means really being in touch with what your employees need. And I love there's a philosophy by a person named Bird Bagot that I have adopted, it's called the three levels of leadership. And level one is that when people understand you, you get their attention. When people trust you, you earn their loyalty.  And I think if managers and supervisors really realize that the more they connect, the more they show compassion and real caring for their employees, they're going to get it back tenfold in terms of loyalty, productivity, willingness to cooperate, engagement. And so it's a win-win situation that we're trying to create. That's wonderful. I know we started having our town hall meetings here in Honolulu. Let's talk about town hall meetings. Sure. I think that it's important that they be planful and really take into account what people have heard, what the leaders have heard in their individual meetings. There are some common concerns around safety, fear of getting coronavirus and desires to have the flexibility that they may have experienced at home and wanting to bring that back to the workplace. And so taking into account what they've heard and then hopefully the task force groups, and we've made some recommendations around task force groups, around safety issues, around self-care and group connectedness, around policies and procedures, and around innovations in the business. And for my business, also, we're doing, well that would be business innovation around telehealth because a lot of us are doing telehealth, teletherapy at this point. So anything new that you've done, you know, we are trying to have work groups to make recommendations. So you want to take those into consideration. And then the leaders having gathered all that information from the individual meetings and from the work groups, then they can kind of cite some major objectives that they want to accomplish. The first one, the first town hall is going to be about how do we re-enter safely? And that will be, again, policies and procedures, you know, the equipment that's going to be needed. And I've seen some good materials also on having employees sign agreements that everyone is going to adhere to the same behavior to keep each other safe. Okay, I like that. So continue to help us chart a path forward regarding workforce development and training issues. So I think if you want to take the safety piece first, then it's really around what are the procedures just coming into the building. Again, I can give our example most easily. We have, you know, administrative staff, we have clinicians, and we're in a medical building. And so we have to work very closely with the the people who own the building and making sure everything is clean and disinfected on a regular basis. We'll have to have our own cleaning supplies so that as people come in the door and as they use the offices that we're cleaning in between each time that, you know, that we've even gotten something from them on elevator use versus the stair use. So then we have to have our PPE equipment, make sure we have our masks or we have our glass, the facial things that you can see each other, we would prefer that rather than having masks on as much as possible. We've also been looking at practices that other doctors offices are doing so that they're only either screening clients before they come in. Obviously, if they're not well, that we will schedule telehealth as opposed to having them come in. But they only come in one at a time. There's no more waiting room. People don't come into the waiting room. They come in straight to the sessions and no more group conferences. We can only use spaces where you have at least six feet distance. And then we're going to be flexible and having people come in, not all at once. We have 50 clinicians, so we have to be mindful of how many people can be in the space at any given time. So all of those things, you have to adopt it to your own business. So this is, people do need time, organizations do need time because you need to be very organized and have a mindset of safety first before the dollar bill. So this sounds comforting. You have what four clinics and you have over 50 employees. So these are excellent, excellent advice. This is Dr. Barbara Brown. And we are talking about business reentry, post-COVID-19 quarantine. And to me, my personal view is I'm thinking about going back into the world.  We were talking about the salons. We were talking about our nails and hair and eyebrows and shopping. And I think that people now need to just have common sense. It is common sense, but I do think the idea of a walk through, you know, and kind of to make sure that you've gotten all the details because it can get that it's common sense, but you want to make sure that in your space that it will work. All right. Well, Dr. Brown, we are going to take a short break. And when we come back, we'll continue our conversation about business reentry. Keep it there. Aloha. I'm Keisha King, host of Crossroads and Learning on Think Tech Hawaii. On Crossroads and Learning, our guests and I discuss all aspects of education here in Hawaii and throughout the country. You can join us for stimulating conversations to enrich, enliven, and educate. We are streams live on Think Tech biweekly at 4 p.m. on Mondays. Thanks so much for watching our show. We look forward to seeing you then. Aloha. Welcome back to Sister Power, and we are chatting with Dr. Barbara Brown about the U.S. business reentry post COVID-19 quarantine, and she is giving us some wonderful advice. So if you have a chance to grab your pencil and paper, this is a time to do it now. So Dr. Brown, let's talk about tackle stress and empowering others to do the same. Because we were chatting earlier, that first day back at work is going to be, that is a time that people need to feel really good. So can you give us tips on professional ways to quickly ease stressful situations involving employees? Well, I think the first way is trying to minimize the level of uncertainty that people have. And by, again, having the task force groups where you laid out things in particular, people know how they're going to enter. And as predictable as it can be, it will really alleviate a lot of anxiety and fears. And then when people come in, having check-ins with them to make sure things are running smoothly. And if there are any problems that occur, trying to do problem solving as quickly as possible, because as perfectly as we may plan it, things don't go perfectly. And you find out more as you enter. So we need to be conscious that we need to do problem solving along the way. And as long as they feel that, as employees feel that you're being responsive, you're being observant, and you're reaching out when you need to, it will go pretty well. Well, that's comforting. How to manage your team with empathy while driving results during times of high stress. I think that having good discussions with them about their roles and responsibilities at work and having them have some input in how they think they can best do it. Again, you're going to need more flexibility in coming in because you can't bring everybody in probably all at the same time. And so that's going to be done in kind of phased in work because you can't have as many people and you can't do business as usual. So you may be, instead of having group meetings together, you can't do that. And so you may have to continue to have them by Zoom or something like that. And so the flexibility that you need and having people have a say in how they can best produce what they need to and having those agreements will help and everyone be on the same page. Great. Yeah. Let's talk about coping mechanisms that help you refocus and drive forward with an actionable plan. So I think the best way to answer that is to have people have some measurable goals that they can come in with. And so the expectations being clear and to when people are feeling stressed, being able to talk about what they need in order to feel better. And again, if they're not feeling comfortable in the workplace, having the flexibility to still work off site as much as needed. And so I think being able to state what they need to their employers and being heard and being acknowledged will be very helpful. Okay. Yeah. That makes a lot of sense. So how do you obtain actionable ways to gain perspective and lead with logic? Well, I think that hopefully there is a culture that your company has and some driving forces in it. And so again, for our company, we want to not only deliver high quality mental health services to our clients and meet their needs, but we also want to make sure that the clinicians are also doing self care and doing things in a way that they won't burn out themselves. That's true. Absolutely. Because with the country back to work, how do we process that? Moving forward. How do we process getting back to work? Back to work. Yeah. Before we get there, we're sitting at home right now. I mean, it sounds wonderful, but there's a process that we need to go through. I agree with that. I think that again, it's like having a countdown process, five, four, three, two, one, and having some agreements on when to go back to work and probably going back in measured ways instead of trying to force going back full time the first week, going back in phases. Some Americans may work at home forever after COVID-19. What are some of the advantages and disadvantages? Well, people have a lot of flexibility at home. And without the commute time, it's less costly often. They can, again, make their schedules work more for them. And so that is an advantage. I think we're trying to think about any liability issues as well of being home working and not having as much engagement with the company. So we're working on ways to have regular meetings, by Zoom, maybe having some mandatory times where people do get together. We're trying to think that through so that we can have the best of both worlds. That sounds like that. That is comforting as well because you're thinking ahead about the live bills for your employees. Go ahead. I'm loving your advice. We also are thinking about the cost of working at home. We pivoted very quickly, but people are using their own equipment, their own laptops. We're not providing those things, and we have to think through whether we need to do more for them if they are going to continue to work at home. We're providing Zoom and telehealth, but there may be more we need to do. Name a few key strategies to help supervisors support employee well-being during COVID-19. Again, having regular reach-outs, regular meetings, both team meetings, as well as individual meetings. You can also have fun things like I've been hearing people having happy hours with cocktails or mocktails, having Secret Santa where people are drawing names or picking random names and sending gifts. I've heard also people having exercise competitions where how many steps can they do. So fun ways of connecting as well as business ways and meetings. That sounds like fun. Dr. Brown provides the viewers with the ideal snapshots or of reentry into the workplace. Okay, so an ideal scenario is someone has been in touch with their manager. The manager really understands what they've been going through during this period of time, note of any stresses that they've had and giving them resources if they need them, or understanding about the flexibility that they need coming in, that they have a sense of safety and they know what's going to happen in terms of maintaining that safety when they come in the workplace, and they have their set of roles and responsibilities and their priorities made that they've done collaboratively with their managers and they implemented. Okay, let's go back and let's talk about the task force groups. What are the action steps for task force groups? Well, basically working with the managers, they decide on a set of procedures that are going to be best practices for whatever they're doing. So say, again, we've talked a little bit about the safety groups. So they have to think through all of the things that need to be done and all of the different subgroups within the agency. So again, whether it's administrative staff, labor force, managers, professionals, they have to each group needs to be part of those subgroups to say what is needed for their particular task to be done safely and how are they going to work together. For the telehealth piece that we have or the business innovations, again, thinking through how many people are going to do that. What is that going to cost for the company? What liabilities are there in these new innovations? What are the new policies and procedures that need to go with the new practices? It is important for managers and supervisors to let employees know that their safety, well-being, enrolled in the company matters. Give us more advice about that because that's going to be very crucial for the employees coming back into the office. A lot of it is letting them talk about what are they afraid of? What is driving them? And a lot of what I'm hearing from both clients as well as from my own staff is that some people have underlying medical conditions that have to be taken seriously and they may not feel comfortable coming back until there's a vaccine. Other people have elders or children in the home and they don't want to infect them and put them at risk. For others, it's just really simply that, again, it's the normal fear to have to get sick and potentially die. You just need to make sure that you're thinking it through in terms of their commute, to their time in the office, to just being in public. And they have not been. Some people have been less so than others. This is true. Is there anything that we haven't covered in the last two minutes that you can share with our sister power and think tech viewers? I just think that leaders need to, again, have a compassionate heart, have really good listening skills and really understand their employees, be helpful where they can, provide resources where they need to be given to them and be clear in communication and maintain humanity over all else. Thank you, Dr. Brown for this soothing advice that is so needed moving forward with the reentry into the workplace. And we want to thank our sister power viewers. Please take care of yourself and each other. Aloha.


Welcome to the last talk of Saturday today here at DAFKON and Track 3. So this is the CSRF Resurrection, starting the unholy trinity, service worker of PWA, same set of HTTP cookies and fetch. Please welcome Dong Sun Kim. Right. Sorry for making you wait. Thank you. Well, this is the last time, so I can use whatever the time I have. Thank you. Good evening. Thank you for coming to my talk. It's so great to see you all in person. So I'm excited to present my research, the CSRF Resurrection, starting the unholy trinity, service worker of PWA, same set of HTTP cookies and fetch. That's a long name. Before we begin, let me introduce myself. My name is Dong Sun Kim. I'm an IT security expert at the security office. We are based in Sweden and in South Korea and a part of the TRUFSA Group. If you have any questions or comments, please feel free to reach out. So firstly, let's touch on the current landscape of the web and what we are going to discuss. The web platform is evolving faster than ever before. Every day, new features and APIs are constantly being proposed, developed, tested, shipped and standardized. They not only include aesthetic improvements but also open powerful operations to web developers like such as web USB, web GPU, NFC, serial, socket, sensor, et cetera. Then what does it mean for security? Well, new technologies bring new security problems to consider. They are intertwined with each other, which by nature it is highly complex to maintain. Basically researchers like Frank and Adal took a look at browser features such as PDFJS, app cache, pre-render, web socket, et cetera. And they discovered that for all browsers, at least one cookie protection policy can be bypassed. Some of the findings that had been fixed were reintroduced. Millsdown and Spectre, they changed our way of thinking about the traditional web threat model. Powerful web APIs such as performance or shared array buffer had to be disabled or reduced. This showed the complexity of keeping the web secure, although every step of the way gets thoroughly reviewed, errors slip through the cracks. In this talk, I will put my focus on that complexity, especially we will discuss HTTP cookie same site, PWA service worker, then how the three can bring back CSRF from the dead. So let's dive in. First, same site cookie, the conclusive entity to CSRF. But before we even get to same site cookies, let's start with what actually is HTTP cookie. So HTTP cookie is a state management mechanism built on top of the stateless HTTP protocol. It defines two headers, cookie for request, set cookie for responses, typically used to store server session identifier, or from a random secret, in the client storage. Then user agents or clients or browsers always send appropriate cookie value, but only with the matching requests. What we are going to focus is the matching part. What does that matching mean? If we dissect the below example into parts, session is the cookie value. No, cookie names, sorry. Session, a secret nonce is the cookie value. Domain and expires are the attribute names. And example.com and the written date are the attribute values. So matching is mainly about the attributes. The domain attribute states that this cookie is for example.com and the expires attribute states that it should be discarded after that specific date. Assume the user agent accepted the set cookie header when the user agent makes a request like image.gif. Since the domain is a match with the server and the expiration date is a match with the clock, it will include the cookie value in the cookie header. That's kind of about it, and that is a problem. The cookie standard put it bluntly, quote, for historical reasons, cookies contain a number of security and privacy in felicitates. Just to name a few, third party cookies, super cookie, eavesdropping, cross-site scripting, and cross-site request forgery. What we're going to focus on is the cross-site request forgery. Then first, what is cross-site anyways? What is cross-site and cross-site request anyways? Let's consult the specifications. First, we need to define what an origin is. An origin is defined as a tuple of three elements, a scheme, host, and port. Below on the left side are URLs, and the right side are the origins. A URL like hpsexample.com slash page becomes a tuple of hpsexample.com443 as its origin. If the host is different, like sub.example.com, or if the port is different, port is custom, like 8443, the tuple changes, hence the origin is different. Then we need to define what a registrable domain is. It is a domain name the internet users can or historically could directly register. A registrable domain is defined as a public suffix of host plus one additional label. A public suffix list is a database of effective top-level domains. It contains names like COM, CO.UK, github.io, ngrock.io, et cetera. If the host is example.com, then its public suffix becomes just COM, and plus one additional label becomes example.com, which is its registrable domain. For sub.example.com, its public suffix is COM, so registrable domain is example.com. The same as the last one. The registrable domain of a sub domain is the same as its parent domain. Next, we define what a site is. A site is defined as a tuple of two elements, scheme, registrable domain. We are using the same examples again, and the schemes are the same, but the hosts and ports are slightly different. But since their registrable domains are all example.com, the site, a tuple of HBS, example.com, are all the same. Hence, the origins are all same site with each other. Then we need to choose which one should be the site for cookies for a given request. This varies under different circumstances, but for the usual browsing cases, it is the document's top-level origin, also known as the URI, displayed in the address bar. Simple as that. We need to define one more thing, and the client object of a request. This is an object that holds, among other things, contacts for JavaScript and browsing, and an origin used in security checks. We'll denote it with curly brackets, like so. With this information, we can finally define what a same site request is. The request is same site when it satisfies, A, the request URL's origin, is same site with its client site for cookies, B, the request URL's origin, is same site with every URL in its URL list. C, the request is not triggered by a user pressing the reload button. Moving forward, we will only focus on the first criteria. Then, a cross-site request is defined to be a request that is not same site. That was quite formal, but so let me give you a basic example to make it more digestible. As we discussed, a site is a tuple of scheme and registerable domain, and the typical site for cookies is the user agent's address bar. Below is a document hosted at hpsexample.com, and this is our site for cookies for the rest of the example. Its site is a tuple of hpsexample.com.  So clicking the link will spawn a request, since the request URL's origin site is the same as that of site for cookies, which is the address bar. It is a same-site request. Also, clicking a link will make the browser navigate to the URL. It's a navigation request and also top-level request, top-level since the document does not have a parent document. It is also an HTTP safe request, since as per the HTTP semantics specification, the GET method is considered safe. Embedding an image will also spawn a request. The URL is hpsexample.com slash image.gif. Like the previous link, it is a same-site request. If a request is for an image, audio, script, style, etc., we call it a sub-resource request. It is an hbget safe request, just like clicking a link. Now, there is a different link to hpsexample.com. Its site becomes a tuple of hps and victim.com, which is different from that of site for cookies, the address bar. It is a cross-site request. Just like the previous link, it is a top-level navigation request and an HTTP safe request. Finally, we have a form for hps victim.com. Like the previous link, it is a cross-site request, submitting the form will make the browser navigate to the URL, so it is a top-level navigation request. But since the form's method attribute is post, it is now an HTTP unsafe request. Now we know what a cross-site request is. We can define what a CSRF is. It is when an attacker forces a victim to execute forged cross-site requests. It is possible because, as we discussed, the user agents send the cookies with matching requests. Below is an example. Let's say user is visiting example.com, and it has a forged form which has malicious inputs like deletes and all. Submitting the form to victim.com by making the user click on it or using JavaScript will spawn a cross-site request, so a top-level navigation request and an HTTP unsafe request. Crucially, the user's cookie will be sent. The server will recognize and authorize it as the user to run the malicious commands. It is indeed possible to perform CSRF with the HTTP get method like clicking a link or embedding an image as long as the server is susceptible. There are many known methods to mitigate CSRF. These are the mitigations, and one of them is to adopt the same-site policy. So the same-site attribute introduces an additional attribute to the matching process. If the attribute is set to strict, then the browser sends the cookie only for same-site requests. The browser does not send the cookie for clicking a cross-site link or embedding a cross-site image nor submitting a cross-site form. But same-site lacks is like strict, but there is an exception. It allows cross-site top-level navigation safe requests. What it means is that the browser will send the cookie only when clicking a cross-site link with our previous examples, but not when embedding a cross-site image but not when submitting a cross-site form. If it is set to none, the browser will behave just like before. The same-site-ness is ignored and the cookie is sent. Let me show you how it's all supposed to work. We start with the victim page here where it echoes the cookie header of the browser's request. It shows three cookies, none cookie one, lacks cookie two, strict cookie three. You can see the same-site attributes are set respectively. Let's navigate to the attacker page and then navigate back to the victim page by simply clicking a link using get method. Now the page echoes only two cookies, none and lacks, meaning the browser did not send a strict cookie since it was a cross-site request, even though they are actually properly stored. We tried the same by submitting a form using post request. Now the page shows only one cookie, none, meaning the browser did not send less cookie either since the request was HP Unsafe. So that is a quick look at how it's all supposed to work with same-site attribute. The same-site attribute has been widely supported by browsers, but the adoption has been kind of slow. Then in 2020, Chrome started treating cookies without same-site attribute as lacks by default. The cookie draft standard has been also revised, so there has been some sentiment that CSRF dead is really dead. And same-site cookies alone are sufficient to protect against CSRF. We're going to leave it at that and move on to a different topic. And the next is our next topic is Service Worker, PWA's network layer. So Service Worker is one of the core technologies of Progressive Web App. Progressive Web App in a nutshell is a type of web application that is native-like, installable, and offline. Service Worker runs in a worker context, meaning it is running in a different thread from the main JavaScript execution context. Service Worker can act as a proxy server between web application, browser, and network. It can intercept network requests then respond with custom responses. Together with cache storage API, it makes offline fallback pages possible in a web application. Service Worker is mainly used for custom caching strategies by a front-to-end web developer, just like Twitter on the right example. So this is how caching works with Service Worker. There are roughly four layers to consider. The HTML, CSS, JavaScript layer on the top. In the middle, the Service Worker interacting with cache storage API. The browser with its HTTP cache, and the server. So let's say the HTML layer requests an asset. It could be an image, a video, a CSS file, a JS file, et cetera. Then a fetch event is dispatched to the Service Worker which intercepts the request. Here, a web developer can implement their custom caching strategy using JavaScript and cache storage API. In case of a cache miss or an expiration or else, the Service Worker can call the fetch API using the event's request. Then the browser makes use of its HTTP cache strategy based on the headers. Cache control, expires, et cetera. If that also encounters a cache miss or else, the browser makes an HTTP request to the server over the network and receives an HTTP response. The HTTP response is handled, then passed to the Service Worker in the form of a response class object. The Service Worker then receives the object, stores it in cache storage, then passes it into the event. So let's implement this flow with a code example from the perspective of a web developer. Before anything, we register the Service Worker. This does not require any user interaction and the developer will typically just want it to happen as soon as possible. The Service Worker looks like this. It adds an event listener on fetch, then starts intercepting all requests. If there is a request in this example, it's an image, it triggers and dispatches a fetch event to the listener. Now the callback function is called to handle the request, the function checks if there is an existing match in the cache storage. If there is a match, it is returned to the event.respondwith method. We call this the cache flow. If there is no match, we call the fetch API simply using the event's request as is. We call this the path through flow. The browser returns a response object which also gets returned untouched. Then finally, the image receives the response object. The cached flow isn't required. The Service Worker can simply path through every request. Then we will revisit this example later. For more complex or caching strategies, most web developers rely on an open source library to make the job easier. One of the most popular ones is Workbox, created and maintained by Google Chrome. It is a collection of JavaScript libraries for PWAs. Importantly, it includes Service Worker routing and caching modules. We simply import the Workbox-SW.js. Then the developer can specify whatever custom cached strategy they want. In this Workbox example number one, a route is registered such that if the request is for an image, it uses a strategy that looks up the cache first, effectively caching all the image assets. Then a default handler is registered so that all the other unspecified requests will only go to the network. Something like this is also possible. Workbox example number two, a route is registered such that if the request URL has a path name of slash transfer, it should only go to the network, but will time out after 600 seconds for post requests. The intention is to make the request wait a little bit more because the server is slow somehow. For React development, Create React app provides a built-in support for Service Worker and caching. Inside index.js, there is a line that can be changed. Changing the method to register registers service-worker.js as soon as the page is loaded. It is also using Workbox under the hood and customizable. We'll also revisit the examples later. Now that we learned same-site cookie and service worker, let's get into the main part, the collaboration that leads to CSRF. We will take a deep dive into the specifications to spot the smells radiating from them. This is going to be a bit crude and simplified read, so bear that in mind. The scene is familiar. It's the same example. We have a service worker registered intercepting and passing the request through. Then we have an image element waiting to be loaded by the browser. As per the HTTP specification, when updating the image data, the browser should simply fetch the image request. But how does that actually happen? As per the fetch specification, the browser should perform fetching, main fetch, scheme fetch, and HP fetch. In the middle of the process, since we have an active service worker, 5.4, set response to the result of invoking handle fetch for request for service worker. Then what is handle fetch? We look at the service worker specification. Appendix A, handle fetch, let E be the result of creating an event with fetch event, dispatch E at active worker's global object. Now the event is created and is passed on to the service worker. The service worker code is the same. It is a path through. Simply fetch the event's request, then return the response as is. But then what does that fetch method do? As per the fetch spec, the fetch input init method steps are let request object be the result of invoking the initial value of request as constructor with input init as arguments. That is one sentence. Then let's see what the constructor does. For the request class, 6.2, set request to inputs request, then 12, set request to a new request with the following properties. What's happening here is that the browser creates a new request object out of the input request object, copying one property at a time. But then there's something peculiar. The origin of the new request is set to client, a placeholder string, meaning it will follow its client object. Then what's the client object? It's this object, context and origin. This is context and origin. At this point, this points to the service worker, rather than the requested image or the HTML. This is a red flag. Then how is the cookie header computed? Let's continue fetching. Let cookies be the result of running the cookie string algorithm, section 5.4 of cookies. Cookies refers to the IETF spec, so let's look into that. In that spec, there is a separate section for service workers. Request which are initiated by the service worker itself via direct call to fetch, for instance. On the other hand, we'll have a client, which is a service worker global scope. Its site for cookies will be the registrable domain of the service worker's URI, unquote. Some familiar words here, but the point is that site for cookies is always the service worker's URI, rather than that of the image request. Same situation, same red flag. What happens if attacker.com comes into play, which embeds a cross-site request to victim.com? The service worker is hosted at victim.com. Site for cookies is always the service worker's URI. The request URL, victim.com slash image.gif, is same site with its site for cookies, victim.com slash sw.js. Suddenly it is the same site request by definition. Looks like CSR is back, so let's put it to the test. We are going to revisit the previous code examples, but this time we are adding an attacker. The attacker has two elements, a link and a form. Activating other will trigger a fetch event, then path through to the server. We have the same setup, a victim page which echoes the cookie header. Non-lagged strict cookie set in the browser. Let's register the browser, register the service worker. Now it is listening for fetch events, and the code itself is simple path through. Let's navigate to the attacker page. Then navigate back to the victim page with a link. As per the same site policy, the strict cookie should not be sent. It is a cross site request. Only none and legs should be sent. But now it shows all three cookies. The browser simply disregarded the same site policy. Let's try the same with the form. Now as per the same site policy, now only the non-cookies should be sent. But all three cookies again. Thank you. Now let's try that again without the service worker. Then it's resend and it's non-cookie alone. Then let's look at the work box example number one again. The developer's intention was simply to cache all image assets and then for all the other requests to go over the network only. Then we will add an attacker to the mix. The attacker has two elements, a link and a form to the endpoint slash transfer. We have the victim page here with login and logout functionality. Clicking the login button would set a session cookie with same site strict. You can see the page shows we are authorized. Let's navigate to the attacker page and navigate back to the victim with link. As per the same site policy, the strict cookie is not sent so we are unauthorized. Trying again with the form, still unauthorized. So let's go back and let's register the service worker. It's listening for fetch events and the code looks as we discussed. Let's try the same and click on the cross-site request and we are now authorized. However, submitting the form does not get us authorized. So what happens is that... Here we go. What happens is that setting the default handler itself makes the service worker path through all the requests. Doing so only applies to HP get request, hence only affecting the link, not the form. However, workbook example number two can make things worse. The intention was to simply change the timeout setting. Let's add the same attacker to the mix. We have the same victim here, but there is an additional logic in the service worker. A prolonged network timeout for post-request transfer. Let's try the form on the attacker page and now we are authorized. Let's revisit the create-react app example. The attacker has one element linked to the victim's secret image. We navigate to the victim like so. Immediately there is a service worker registered to the browser without listening for fetch events. Clicking the login button would set a strict session cookie. You can see we are logged in. Let's navigate to the attacker page and navigate back to the victim page. You can see the image here despite the same site policy. Just to be sure, let's de-register the service worker and try again. Now it returns forbidden as intended. There is one more thing here. We are using this first example again. We are doing the same demo one more time, but this time with Firefox developer tools opened on the network tab on the right. Register a service worker listening for fetch events. Navigate to the attacker. Then the client wrongly sends all three cookies. So it's the same. But when we examined that specific request in the developer tools and the request, it says only none cookie was sent. This was supposed to happen, but what actually happened is quite opposite of this. Okay, let's talk about patches and updates. Yet issues still remain. So I reported this problem in the August of 2020 as it impacted both Firefox and Chrome, two separate reports were sent. And then in October, an issue on the cookie specification was independently opened. It was about the site for cookies problem that we previously discussed. Then in the August of 2021, a security bug on the origin header was independently reported. It was related to the origin problem we previously discussed. In September, other researchers started noticing the same problem, so duplicate bugs were independently reported. In October, a service worker spec meeting on the CSRF issue was held. It spawned about 14 separate issues in different specs, including service worker, fetch, and storage partitioning. Three weeks later, Chromium patched both bugs, and in December, the fetch spec was amended. As we discussed, the problem was that the origin of the new request was client, and the client was pointing to this, which was the service worker itself. Now the amended spec properly propagates the original request, origin information. In the January of 2022, finally Chrome 97 was released to the stable channel with the fix, and the next day, Google assigned the CVE. On July 27th, the cookie spec was amended so that the site for cookies logic is handled by the service worker spec. So no update for Firefox is available as of now. The affected versions are Google Chrome from 51 up to 97, and Mozilla Firefox from 60, and for the developer tools bug is from 74. There still is one remaining issue, and that is a nested frame. In case of victim one, let's say news.com, and embed an attacker at .com, which also embeds victim two news.com. Since the nested frame and its parent, the nested attacker frame, are cross-site, you cannot set nor send a strict cookie. But if we register the path through a service worker, listening to fetch events, now access is possible. This particular problem is to be addressed with the client-side storage partitioning spec. So then conclusions. To recap, in this talk we discussed same-site of HTTP cookie centered around cross-site request and CSRF. We discussed the same-site attribute and lexed by default as a defense against CSRF. Next, we discussed service worker or PWA. We discussed the caching flow with service worker and code examples. Then we moved on to CSRF resurrections. We took a deep dive into the related web specs and how same-site defense gets bypassed when a service worker is involved. Using the code examples, I showed how a developer can easily introduce this problem. Finally, we talked about the aftermath. The disclosure timeline was mentioned, and we discussed the remaining issue of a nested frame. Let's finish up with takeaways. Firstly, do not use same-site cookies as the sole defense mechanism against CSRF. They should be considered as an additional layer of defense. As plainly written in the cookie specification, quote, developers are strongly encouraged to deploy the usual server-side defenses to mitigate the risk more fully, unquote. Also, double-check network interactions with other tools whenever possible. The browser's developer tools might not actually depict the reality in some cases. Since it is still an ongoing problem with Firefox and the nested frame, this is a new attack factor until the issues are fully resolved. Finally, is there any other subtle, complex specification-level problem that has been overlooked and how do we find it? And that's it. I'd like to thank Oscar and Louis for the feedback and Betty for proofreading. Thank you all very much for listening.