News for hackers. Stuff that matters.

A comment on Firefox Profilemaker. Parent comment

Re:Firefox Profilemaker by jolmg on Monday December 03, 2018 @08:36PM (#18595086)
If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.
[ Parent | on HN ]
Re:Firefox Profilemaker by tinus_hn on Tuesday December 04, 2018 @05:24AM (#18598107)
It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.
[ Parent | on HN ]
Re:Firefox Profilemaker by xte on Tuesday December 04, 2018 @07:54AM (#18598947)
Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them.

Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.

[ Parent | on HN ]