2 ms·
This is a 13 year old dead bug report. They literally moved it to the graveyard. Plus the request itself doesn't serve a real security purpose. The supposed pu
by Someone1234 8y ago
This is a 13 year old dead bug report. They literally moved it to the graveyard.
Plus the request itself doesn't serve a real security purpose. The supposed purpose is that if another process is running in the user's context that they cannot "spy" on that user's browsing activity. It won't work.
Another process running in a user's context also has enough access to spy on the master password/decryption key, or just grab the already decrypted files, and therefore encryption becomes a minor roadblock with significant performance costs.
If you're worried about e.g. Roaming profiles on Active Directory you need not, Firefox by default stores profiles in %LocalAppData%, and typically in that situation your corporate overlords are already spying on your browsing upstream (either via DNS or transparent proxy).
This is security theater.
- kazinator 8y ago> This is security theater. Today it is more widely recognized that the applications within a given user context can benefit from limited scopes. And we have various mechanisms for that, ranging from things like Android app permissions to SELinux to the BSD "unveil" syscall and so on. Of course, an encryption scheme in the application isn't the answer.