3 ms·
If "an authenticated context such as HTTPS" isn't being used -- regardless of the presence of this extension -- isn't your computer already "subject to an execu
by jlgaddis 9y ago
If "an authenticated context such as HTTPS" isn't being used -- regardless of the presence of this extension -- isn't your computer already "subject to an executable planting vulnerability"?
- IncRnd 9y agoMaybe. That isn't exactly true. This adds the ability to persist a new threat. There is a temporal difference. An attacker may wish to plant something today, in a coffee shop, that would execute in a protected environment, tomorrow. Immutability of caching can only help an attacker. Yes, there are other ways for an attacker do this, but there is no reason to add to more ways! That's why the web is in its current state. I see how you put "executable planting vulnerability" in quotes. Sometimes (in the current marketing), these are called APTs, but they have been around forever. e.g. Think of dll planting in Windows and the millions of attacks and three or four new API sets from Microsoft that resulted from that single ability to plant a dll in the search path. This type of persistence can also be called incubation.