News for hackers. Stuff that matters.

A comment on Chrome lets hackers phish even 'Unphishable' Yubikey users. Parent comment

Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by tedunangst on Friday March 02, 2018 @12:55PM (#16503969)
Assuming the sandbox works. If the sandbox is porous, the attack surface balloons from apps I choose to install to every link I click.
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Friday March 02, 2018 @02:26PM (#16504800)
Not every link you click. Only sites that you grant access to the necessary attack surface. The Web USB API can't be attacked by sites that you haven't granted access to it.
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by codedokode on Friday March 02, 2018 @04:06PM (#16505687)
What if that privileged website has XSS vulnerability?
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Thursday March 08, 2018 @12:37PM (#16546010)
Then the attacker gets access to that USB device. (And only that USB device.)

What if your unsandboxed native USB utility has an RCE vulnerability?

[ Parent | on HN ]