News for hackers. Stuff that matters.

A comment on Making an SSH client the hard way. Parent comment

Re:Making an SSH client the hard way by shp0ngle on Thursday October 27, 2022 @04:21PM (#33363482)
It doesn’t have the keys, but it can inject any javascript and do whatever the user can do.
[ Parent | on HN ]
Re:Making an SSH client the hard way by Spivak on Thursday October 27, 2022 @04:39PM (#33363723)
To me it seems they've taken all precautions they can reasonably take -- "what if the user installs a keylogger" isn't fixable by anyone.
[ Parent | on HN ]
Re:Making an SSH client the hard way by gunapologist99 on Thursday October 27, 2022 @06:46PM (#33365031)
"Installing a keylogger" is a vast oversimplification, even if it is outside of their threat model.

Installing almost anything in your browser is usually a matter of a couple of clicks.

[ Parent | on HN ]
Re:Making an SSH client the hard way by ithkuil on Thursday October 27, 2022 @08:08PM (#33365794)
Like intercepting your oauth token next time you login into SSO and then use that to access your tailnet.

This was true even before this new feature.

The new threat model is entirely psychological.

[ Parent | on HN ]