3 ms·
That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an
by simias 9y ago
That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an unprivileged app or website.
The equivalent scenario with sudo would be to have a website display a mock terminal asking for sudo password, although that would be a lot harder to do inconspicuously because I don't expect terminal windows to pop out of the blue. It's also the reason why browser notify you when a page wants to go fullscreen.
I think the right solution to this problem is simply not to have privileged system UI elements drawn in a way that can be mimicked by a regular app or website. LastPass made a similar mistake: https://github.com/cxxr/lostpass https://github.com/cxxr/lostpass
I don't have an iphone so I'm not sure what would be the right way to deal with that. AFAIK apps can draw to the entire screen surface so it sounds tricky to avoid.
- amelius 9y ago> That's slightly different though, in order to do this you need to have shell access on the target's computer. But I suppose any application can write to the current user's .bashrc file right? Then it can also set the alias whenever the user opens a terminal.
- vortico 9y agoThat's what shell access means. Running a program = access to system() and thus shell access.
- simias 9y agoI don't think running a native application on a desktop is similar to running a sandboxed app on iOS. The security implication is wildly different IMO. I think a webapp is a more apt comparison.
- dEnigma 9y agoMaybe the actual password dialogue could contain some kind of visual code, like the one on paper money. Then the OS could detect when a fake password input is shown to the user, just like copy machines detect it when you put a bank note in the scanner.