Re:The Effectiveness of Publicly Shaming Bad Security
by Xylakant on Tuesday September 11, 2018 @09:34AM
(#17959552)
No, there's a reason password managers should be preferred. For example, sometimes (browser) sandbox escapes grant reading of arbitrary files. Take for example the recently discussed malware scanner the sent the browsing history, it could read such a file and transfer it back.
[ Parent
| on HN ]
Re:The Effectiveness of Publicly Shaming Bad Security
by UncleMeat on Tuesday September 11, 2018 @06:06PM
(#17963824)
If you have malware on your device you lose already. It can just read memory out of your browser process and steal your passwords.
Re:The Effectiveness of Publicly Shaming Bad Security
by thaumaturgy on Tuesday September 11, 2018 @07:54PM
(#17964470)
"Just".
Modern browsers and OS kernels have extensive mitigations against this. Reliably extracting a password from a browser process's heap would be newsworthy today.
Re:The Effectiveness of Publicly Shaming Bad Security
by rileymat2 on Tuesday September 11, 2018 @11:49PM
(#17965416)
I think “just” is apt. If you have a web request to send the password, you will have a url or username string very close by in memory that can be searched for.
Re:The Effectiveness of Publicly Shaming Bad Security
by Xylakant on Wednesday September 12, 2018 @04:03AM
(#17966393)
I specifically picked an example of a malware that was capable of reading arbitrary files, but not arbitrary memory because the authors found a simple way to trick users into granting them this permission set, but not another.
A sandbox escape that allows the attacker to trick the browser into sending arbitrary files back is also substantially different to having malware on your system that can read arbitrary memory.