7 ms·

I don't want to defend Trend Micro here, but since browser history is a primary vector for malware they at least have a reasonable business purpose related to t

I don't want to defend Trend Micro here, but since browser history is a primary vector for malware they at least have a reasonable business purpose related to the intended use of the apps. The contract and permission people agreed to when they willingly installed it and accepted the EULA are probably the distinction between them doing it and you breaking into a system and doing it.

dvdhnt 8y ago
> since browser history is a primary vector for malware Can you expand on this from a technical perspective? > distinction between them doing it and you breaking into a system and doing it. I think a more accurate comparison would be you being given access to a system to perform some work, but then accessing files and performing operations, such as exfiltrating that data, outside the scope of your work.
- throwaway5752 8y ago
  Come on, cut me a break even though I was not 100% precise with my language! I mean browser exploits in general. Unpatched plugins, XSS, spoofing, etc. If they didn't clean up after themselves you could try to correlate an attack with something in the browsing history and try to evaluate it and add it to a shared blacklist. I am not endorsing that, just speculating that could be the well-meaning (if dumb) explanation for this.
  - dvdhnt 8y ago
    Sorry about that! I didn't mean to scrutinize - I just know very little about browser exploits, especially details, and thought there was some specific attack for browser history. Cheers.
    - throwaway5752 8y ago
      No problem at all! I was being a bit tongue in cheek with my response, too. I wasn't really offended or anything.
thesimon 8y ago
>The contract and permission people agreed to when they willingly installed it and accepted the EULA I don't know about US contract law, but some jurisdictions require special notice for "unusual" terms. Just because the EULA was accepted doesn't mean it is fully valid.

dvdhnt 8y ago

> since browser history is a primary vector for malware Can you expand on this from a technical perspective? > distinction between them doing it and you breaking into a system and doing it. I think a more accurate comparison would be you being given access to a system to perform some work, but then accessing files and performing operations, such as exfiltrating that data, outside the scope of your work.

throwaway5752 8y ago
Come on, cut me a break even though I was not 100% precise with my language! I mean browser exploits in general. Unpatched plugins, XSS, spoofing, etc. If they didn't clean up after themselves you could try to correlate an attack with something in the browsing history and try to evaluate it and add it to a shared blacklist. I am not endorsing that, just speculating that could be the well-meaning (if dumb) explanation for this.
- dvdhnt 8y ago
  Sorry about that! I didn't mean to scrutinize - I just know very little about browser exploits, especially details, and thought there was some specific attack for browser history. Cheers.
  - throwaway5752 8y ago
    No problem at all! I was being a bit tongue in cheek with my response, too. I wasn't really offended or anything.

thesimon 8y ago

>The contract and permission people agreed to when they willingly installed it and accepted the EULA I don't know about US contract law, but some jurisdictions require special notice for "unusual" terms. Just because the EULA was accepted doesn't mean it is fully valid.