4 ms·

Do you have any evidence for your claim about "potential exploit vectors", or is it just speculation? I don't know if you can claim Chrome is insecure, simply

Do you have any evidence for your claim about "potential exploit vectors", or is it just speculation? I don't know if you can claim Chrome is insecure, simply because it supports more web standards. e.g. look at the results of the recent pwn2own contest: http://venturebeat.com/2016/03/18/pwn2own-2016-chrome-edge-and-safari-hacked-460k-awarded-in-total/ http://venturebeat.com/2016/03/18/pwn2own-2016-chrome-edge-a... There are other variables that probably have a greater impact on the security of a browser.

deleted 11y ago
[deleted]
ryao 11y ago
In the past, changes to internet standards were about enabling better presentation of webpages. Now changes involve JavaScript APIs that access things traditionally reserved for plugins (which were a security nightmare) and native applications. Doing that can pose unforeseen security risks, such as the supercookie: http://money.cnn.com/2015/01/09/technology/security/super-cookies/ http://money.cnn.com/2015/01/09/technology/security/super-co... Not to mention, I posted elsewhere in this discussion that WebBluetooth seems like a way that an attacker with control of a server can run attacks against bluetooth devices that he otherwise would not have been able to access without breaking out of the sandbox. Once in control of one of those bluetooth devices, it would be possible to attack the system from the compromised devices. It is like giving unrestricted network access to Javascript once a user clicks accept (and they almost all would), except with a different network technology where devices all trust each other not to do malicious things. Given that security flaws can happen when new features are used in unforeseen ways, I am happy to see Apple take its time under the assumption that it is taking its time to implement things correctly.

4 ms·

Do you have any evidence for your claim about "potential exploit vectors", or is it just speculation? I don't know if you can claim Chrome is insecure, simply

by victorhooi 11y ago

deleted 11y ago
[deleted]
ryao 11y ago
In the past, changes to internet standards were about enabling better presentation of webpages. Now changes involve JavaScript APIs that access things traditionally reserved for plugins (which were a security nightmare) and native applications. Doing that can pose unforeseen security risks, such as the supercookie: http://money.cnn.com/2015/01/09/technology/security/super-cookies/ http://money.cnn.com/2015/01/09/technology/security/super-co... Not to mention, I posted elsewhere in this discussion that WebBluetooth seems like a way that an attacker with control of a server can run attacks against bluetooth devices that he otherwise would not have been able to access without breaking out of the sandbox. Once in control of one of those bluetooth devices, it would be possible to attack the system from the compromised devices. It is like giving unrestricted network access to Javascript once a user clicks accept (and they almost all would), except with a different network technology where devices all trust each other not to do malicious things. Given that security flaws can happen when new features are used in unforeseen ways, I am happy to see Apple take its time under the assumption that it is taking its time to implement things correctly.