News for hackers. Stuff that matters.

A comment on Private by Design: How We Built Firefox Sync. Parent comment

Re:Private by Design: How We Built Firefox Sync by jniedrauer on Wednesday November 14, 2018 @05:46PM (#18454915)
The attacker in this case would be Mozilla itself. No need for an MITM. In this hypothetical, a government agency contacts Mozilla and says "Here is a canvas/HSTS/other fingerprint. Please serve this malicious code when this fingerprint accesses the login."

The point is that Mozilla can single out individual users for targeted attacks, whereas they could not do that if they had to put the malicious code into Firefox itself.

[ Parent | on HN ]
Re:Private by Design: How We Built Firefox Sync by martin-adams on Thursday November 15, 2018 @04:29AM (#18457996)
Right I see. So the barrier with Firefox itself, is that the malicious code wouldn't get built into the product and served as an update. However, in that scenario, Firefox could serve a malicious update to a single user, only that it's harder to fingerprint that.
[ Parent | on HN ]