4 ms·
At this point, the only people that should be worrying about Spectre/Meltdown are cloud hosting providers. For individual users, Spectre/Meltdown attacks rely o
by mozumder 9y ago
At this point, the only people that should be worrying about Spectre/Meltdown are cloud hosting providers. For individual users, Spectre/Meltdown attacks rely on malware processes running on your computer, and if that is happening, you have bigger problems to worry about.
- nokcha 9y agoJavaScript code running in a properly sandboxed modern browser can potentially exploit these vulnerabilities.
- d1zzy 9y agoIs some piece of JavaScript loaded in your browser one of those "bigger problems to worry about"? What about some Windows tool I download to help me run games in borderless fullscreen? What about videogame mods? And here I was hoping that running everything as a regular/non-admin user is sufficiently secure... People say "you need to have malware running on your system" as if it's not normal to run other people's code on a desktop system but it's actually very very common and why priviledge separation and user sandboxing is being done in modern operating systems. JavaScript has been successfully shown it can be used to exploit at least one of these bugs.
- CamperBob2 9y agoIs some piece of JavaScript loaded in your browser one of those "bigger problems to worry about"? As soon as I hear of such an exploit in the wild, I'll panic. The demonstrations so far have consisted of arcane research papers and canned videos. Send me a link to a PoC page that returns stored passwords, harvests cryptocurrency wallets, drops payloads, or otherwise screws with my unpatched system. Until then, I think people are grossly exaggerating how big a deal the Spectre/Meltdown exploits are.
- mozumder 9y agoJavascript Spectre/Meltdown attacks are already effectively defeated through browser updates that reduce timer accuracy.