4 ms·

The same can be said for any software that auto update (i.e. Chrome), no?

• eeZah7Ux 8y ago
  No. The risk is much lower, especially if different entities (upstream, linux distributions, ...) review the same code.
• tlrobinson 8y ago
  That depends. 1. Most platforms these days require a signature with a key issued by the platform. In the browser you have HTTPS but that doesn’t help if the server is compromised. 2. It’s easier to target individuals (thus evading detection) if you’re serving the code to users directly (which I think is also the case with Chrome, but not Mac App Store, Linux package managers, etc) 3. Some platforms even do some amount of auditing before including software in their repositories.
• peterwwillis 8y ago
  Attack vectors for replacing Chrome: - Hack Google Attack vectors for replacing OpenPGPjs: - Hack the servers hosting OpenPGPjs - Hack the browser to inject or replace content across domains, sandboxes, other security barriers It's a subtle difference, but delivering applications dynamically via web browsing is much more precarious than natively hosted applications. Another way to think of it is if your entire Linux OS were actually just web apps with GUIs. Every time you run 'bash', it was actually downloaded from a remote server. And every time you used bash, and it used some plug-in which was hosted on some other site, that plug-in could be compromised, and could be trying to attack your OS, which if successful, would compromise your entire host. That doesn't happen right now because all the apps sit on your host, aren't constantly re-acquired, aren't constantly subject to potential 3rd party attacks over a wide surface area. Though this does sort-of happen with programming language package managers like npm, pip and so on. But you can pin those versions and hashes if you're paranoid, which I don't think you can do with a browser.
  • cortesoft 8y ago
    You don't have to hack google to replace chrome. You just have to hack a trusted cert provider and DNS and/or BGP. Those two things are not unheard of.
    • peterwwillis 8y ago
      They're using key pinning, so you would have to use one of Google's keys and use one of Google's authorized CAs. But second, I imagine the auto-update process is using a non-TLS certificate to verify the signed binaries. Either way you have to hack Google. It would actually be much easier to just find a vuln in Chrome that can break out of sandbox and get root.
      • h1d 8y ago
        Or hack the team who signs.
    • kawsper 8y ago
      So Chrome doesn't use certificate pinning for distributing updates?
  • bigiain 8y ago
    > Attack vectors for replacing Chrome: > - Hack Google - NSL Google (If you're a high-enough value target and your adversary is the US Government. But in _that_ case you've probably already lost - you might just not know it yet. I wonder if Snowden uses Chrome or lets it autoupdate?)
    • FrozenTuna 8y ago
      That's a good question. I don't think the government cares enough about snowden to do that. Snowden's damage has been done. It can't be reversed. Imo, they'd be much more interested to preemptively shutdown all future would-be Snowdens.
• Sir_Cmpwn 8y ago
  Yes.