Re:Decrypting TLS Browser Traffic with Wireshark
by nodata on Friday February 13, 2015 @04:41AM
(#9043586)
If the attacker can add an environment variable, they can add a command-line switch or about:config value or modify my firefox binary or install an addon that saves my password fields.
[ Parent
| on HN ]
Re:Decrypting TLS Browser Traffic with Wireshark
by vidarh on Friday February 13, 2015 @07:41AM
(#9044011)
If I carelessly execute ~/Downloads/some-binary, my environment variables and config settings are now suspect , while overwriting my firefox binary requires root access.
As such, having the browser loudly warn (irrespective of settings) about such unsafe defaults is still vastly better.
Re:Decrypting TLS Browser Traffic with Wireshark
by Animats on Friday February 13, 2015 @02:52PM
(#9046779)
As such, having the browser loudly warn (irrespective of settings) about such unsafe defaults is still vastly better.
Yes. Loudly. As in "surrounds entire window with a red frame with INSECURE TEST MODE ENABLED", not as in "pops up notification that quietly fades out".
Re:Decrypting TLS Browser Traffic with Wireshark
by nodata on Monday February 16, 2015 @04:44AM
(#9056030)
But poisoning your Firefox binary does not require root access. Just preload what you want.
Re:Decrypting TLS Browser Traffic with Wireshark
by teddyh on Friday February 13, 2015 @06:36AM
(#9043830)
While technically true, that did not prevent Shellshock from being a big deal.
Re:Decrypting TLS Browser Traffic with Wireshark
by bodyfour on Friday February 13, 2015 @06:51AM
(#9043876)
Shellshock was a big deal because the attacker only needed to control the value of an environment variable, not its name. There are many vectors to provide a string that will end up stored in some environment variable, far fewer that will allow you to specify a particular name/value pair.