3 ms·
I am not talking about ChromeOS - I am talking about the Chrome browser. Localstorage, last I checked, which was recently, is plaintext. > ChromeOS and Android
by libertymcateer 10y ago
I am not talking about ChromeOS - I am talking about the Chrome browser. Localstorage, last I checked, which was recently, is plaintext.
> ChromeOS and Android both implement FDE
Which is irrelevant if the runtime is compromised, which appears to be the case.
- md_ 10y agoLet's be all Socratic here: Given a desktop OS like Windows that implements FDE like Bitlocker and runs a browser like Chrome, can you describe a hypothetical threat in which Chrome encrypting localstorage would prevent exploitation?
- libertymcateer 10y agoYes - worms or browsers that scan local data files without accessing the runtime of the parent application.
- md_ 10y agoSo your threat model is "malware which has access to memory containing plaintext but is written by idiots"? 0_o
- libertymcateer 10y agoDunno if you are still checking this thread, but I had a followup to this question. It seems to me that certain cryptoviruses function in the following way (e.g. certain variants of ransom_vxlock - I will see if I can find a specific example): * The virus functions like other cryptoviruses, encrypting local data and holding it for ransom * However, in addition to holding your local data ransom, it archives certain files that are likely to hold passwords (e.g., the chrome password store), and then emails them to the C&C server If this is the case, would local encryption of the chrome password store be a protection, or would the decryption of this store be trivial the the virus author? Again, assuming that the virus author is a script kiddy. So, basically, I am asking that if the characterization of the virus described is accurate, doesn't that mean that the threat model I describe also actually occurs in the wild? I'm not trying to be facetious here - I am trying to get to the bottom of this. I will try to find links to support the above.
- bitmapbrother 10y ago>Which is irrelevant if the runtime is compromised, which appears to be the case. You're under the false assumption that these exploits are current - they're not. In fact, they're very old.
- libertymcateer 10y agoThese ones? https://www.washingtonpost.com/world/national-security/wikileaks-says-it-has-obtained-trove-of-cia-hacking-tools/2017/03/07/c8c50c5c-0345-11e7-b1e9-a05d3c21f7cf_story.html https://www.washingtonpost.com/world/national-security/wikil...
- bitmapbrother 10y agoWhy not point to the actual ancient exploits from circa 2011-2013 for Android versions below 5 and Chrome versions below 40? https://wikileaks.org/ciav7p1/cms/page_11629096.html https://wikileaks.org/ciav7p1/cms/page_11629096.html
- libertymcateer 10y agoThanks for the link. So then is the assertion that the relevant hacks are all for older versions of Android? How does that comport with the current batch of hacks?
- bitmapbrother 10y agoAll of the hacks are for older versions of Android and iOS. Specifically Android version 4.x and iOS version 9.x. "Apple says most vulnerabilities in Wikileaks docs are already patched" https://techcrunch.com/2017/03/07/apple-says-most-vulnerabilities-in-wikileaks-docs-are-already-patched/?ncid=rss https://techcrunch.com/2017/03/07/apple-says-most-vulnerabil...
- vetinari 10y agoAnd it does not matter - it is in Chrome's homedir, no other app can access it. Wrt. physical store, it is on FDE anyway.
- libertymcateer 10y agoGood sn.