68 ms·
Modern consoles now come with web browsers, and the researchers proved that the attacks could be performed via web browsers, did they not?
by ZenoArrow 9y ago
Modern consoles now come with web browsers, and the researchers proved that the attacks could be performed via web browsers, did they not?
- deleted 9y ago[deleted]
- lrem 9y agoNext patch: we enhanced your security by disabling execution of JavaScript from untrusted domains. In unrelated news, we now block ads!
- ZenoArrow 9y agoIf they are going to block JavaScript, they need to do it for all domains, not just untrusted domains. For example, if I can MITM my own website activity (which I can, by having a device that sits between a router and a console), then I can change the JavaScript coming from trusted domains. In other words, if I visit a site like Google or Facebook on an affected device, I can change the JavaScript that is run, and make it still appear like it came from a trusted domain.
- yorwba 9y agoYou can be prevented from a successful MITM by enforcing HTTPS using HSTS and pinning the keys of trusted sites. That's not a viable solution for accessing the internet at large, but for a console that is only incidentally used for web browsing, it's absolutely an option.
- lrem 9y agoThere are dozens of ways to prevent this, viable because you fully control the hardware and software stack of the terminal (and only allow contacting servers of your choosing). I imagine they are more concerned about game authors snooping keys or whatnot.
- Thiez 9y agoYou can't just mitm when the JavaScript is served over https, unless you also can install your own certificates on the machine you're trying to hack. But when you have permissions to install new certificates you probably don't need the hack in the first place.