Re:Subgraph OS: Adversary resistant computing platform
by ris on Wednesday November 23, 2016 @04:55PM
(#13026079)
> You get exactly this sort of setup if you use WebGL
> I do my most security-sensitive work on a Chromebook
I would highly recommend you use a WebGL whitelist then. WebGL might have been designed with security in mind, but the OpenGL drivers which it, nevertheless, is a very thin wrapper around were, I can assure you, not written with security in mind. WebGL allows some surprisingly direct ways of manipulating hardware and there are a million attack vectors lurking in every WebGL implementation/OpenGL driver combination.
Re:Subgraph OS: Adversary resistant computing platform
by geofft on Wednesday November 23, 2016 @04:58PM
(#13026107)
That's a good point. What else should I whitelist other than WebGL? (Is there a general hardening guide for an off-the-shelf, un-jailbroken Chromebook?)
> I do my most security-sensitive work on a Chromebook
I would highly recommend you use a WebGL whitelist then. WebGL might have been designed with security in mind, but the OpenGL drivers which it, nevertheless, is a very thin wrapper around were, I can assure you, not written with security in mind. WebGL allows some surprisingly direct ways of manipulating hardware and there are a million attack vectors lurking in every WebGL implementation/OpenGL driver combination.