3 ms·

> security risk is the product of defect rate multiplied by attack surface. Call me crazy, but security sensitive application should not have direct access to

by jkot 10y ago

> security risk is the product of defect rate multiplied by attack surface. Call me crazy, but security sensitive application should not have direct access to 3D acceleration, microphone, camera, USB etc.

btrask 10y ago
See the later quote: > (It should also be possible to block or control access to each of these.) The good news is that the capabilities of the sandbox don't need to be every-expanding, the way browsers have been. The sandbox should support everything the hardware can do, and then there are policy decisions about what capabilities web pages actually get.
- jkot 10y ago
  It should also be possible to disable JS. We all know how that worked out.
  - btrask 10y ago
    A better analogy is Android permissions. These days you can fake them and apps mostly still work, right?
    - jkot 10y ago
      I think security model on Android 6 is now different. You can grant permission to use camera for 10 minutes etc...
- TeMPOraL 10y ago
  At this point the sandbox is indistinguishable from your OS.
  - btrask 10y ago
    The difference is priorities. By separating them, your OS can be fast and featureful, and your sandbox can be secure. Better yet if there are several competing, portable sandboxes, so you can choose the best OS and best sandbox separately.
- coldcode 10y ago
  > The sandbox should support everything the hardware can do Until you can emulate a hardware GPU in software at the same performance point, your sandbox is unusable. The web is more than text.
pdkl95 10y ago
Not only should it not have direct access to hardware[1], important data such as private keys shouldn't even be directly accessible by any part of the browser. We've known how to keep keys in their own management process for a long time (e.g. pgp-agent, ssh-agent). [1] Putting USB anywhere near the web may be the stupidest idea I've ever heard. Attempts to add USB access to the browser should be seen as an attack. A camera or microphone can be a serious security problems, but failures in those features can (at least theoretically) be limited to features related to a specific hardware. Failures related to the USB buss can grant access to a lot of hardware that was never designed for security.

by jkot 10y ago

btrask 10y ago

See the later quote: > (It should also be possible to block or control access to each of these.) The good news is that the capabilities of the sandbox don't need to be every-expanding, the way browsers have been. The sandbox should support everything the hardware can do, and then there are policy decisions about what capabilities web pages actually get.

jkot 10y ago
It should also be possible to disable JS. We all know how that worked out.
- btrask 10y ago
  A better analogy is Android permissions. These days you can fake them and apps mostly still work, right?
  - jkot 10y ago
    I think security model on Android 6 is now different. You can grant permission to use camera for 10 minutes etc...
TeMPOraL 10y ago
At this point the sandbox is indistinguishable from your OS.
- btrask 10y ago
  The difference is priorities. By separating them, your OS can be fast and featureful, and your sandbox can be secure. Better yet if there are several competing, portable sandboxes, so you can choose the best OS and best sandbox separately.
coldcode 10y ago
> The sandbox should support everything the hardware can do Until you can emulate a hardware GPU in software at the same performance point, your sandbox is unusable. The web is more than text.

pdkl95 10y ago

Not only should it not have direct access to hardware[1], important data such as private keys shouldn't even be directly accessible by any part of the browser. We've known how to keep keys in their own management process for a long time (e.g. pgp-agent, ssh-agent). [1] Putting USB anywhere near the web may be the stupidest idea I've ever heard. Attempts to add USB access to the browser should be seen as an attack. A camera or microphone can be a serious security problems, but failures in those features can (at least theoretically) be limited to features related to a specific hardware. Failures related to the USB buss can grant access to a lot of hardware that was never designed for security.