News for hackers. Stuff that matters.

A comment on TabFS – a browser extension that mounts the browser tabs as a filesystem. Parent comment

Re:TabFS – a browser extension that mounts the browser tabs ... by vorpalhex on Saturday February 18, 2023 @08:28PM (#34853124)
If your local machine is compromised such that your mountpoints are free game to some tool running.. what difference do you think this will make? Your cookie jar IS STILL exposed without this.
[ Parent | on HN ]
Re:TabFS – a browser extension that mounts the browser tabs ... by IncRnd on Sunday February 19, 2023 @03:43PM (#34861667)
You misunderstand the security implications, so making categorical statements like that isn't useful. While random running processes may be on a developer's machine, that's not at issue here.
[ Parent | on HN ]
Re:TabFS – a browser extension that mounts the browser tabs ... by vorpalhex on Monday February 20, 2023 @01:33AM (#34865591)
/mnt is owned by root, the submount would be owned by either root or your user

your cookie jar is somewhere in ~ (eg ~/.firefox)

If a service has been compromised such that it can exfiltrate /mnt/blah/tab/blah/, it can also exfiltrate ~/.firefox/blah

You're shuffling deck chairs on the titanic.

[ Parent | on HN ]
Re:TabFS – a browser extension that mounts the browser tabs ... by IncRnd on Monday February 20, 2023 @12:18PM (#34870265)
You should read the article. This isn't /mnt but fs/mnt.

In this particular scenario, the article describes the use of FUSE for mounting the files. FUSE stands for "Filesystem in Userspace". This, thankfully, doesn't force running a web browser as root, which would be required in your scenario.

[ Parent | on HN ]
Re:TabFS – a browser extension that mounts the browser tabs ... by vorpalhex on Monday February 20, 2023 @04:32PM (#34873205)
> doesn't force running a web browser as root, which would be required in your scenario.

It would not in any way shape or form be required in my scenario. Please re-read the basics of file permissions on POSIX.

We are asking the question: "Does this expose additional potential security vulnerabilities not exposed with the cookies existing purely in the normal cookie store?"

Our possible vectors of attack are a compromised root owned service and a compromised user owned service. Both of those vectors would allow the cookie store to be exfiltrated regardless of whether this extension is used.

Ergo, this extension does not create any additional security vulnerabilities in that regard.

[ Parent | on HN ]