4 ms·

Considering that pretty much all browser based exploits use JS I'd say the number one reason chrome is not usable for power users is that it used to not be able

Considering that pretty much all browser based exploits use JS I'd say the number one reason chrome is not usable for power users is that it used to not be able to block JS without loading it first. At least this was the case last I checked, haven't really bothered with chrome's technology since its popularity soared ~6 years ago and all my friends started switching to it. Even if this is fixed it will always be my major sore point about that browser.

jchw 8y ago
Are JS-based exploits a real threat anymore? Even if you do find an exploit, it looks to be an uphill battle, because you still have layers of security to break through, and they're going to differ by target OS and browser. Even on platforms where things are fairly predictable, like say game consoles, the exploits look complicated and are often not very reliable. Even in Firefox where the security story is still not quite as far along, I still am not really concerned about JS exploits. And most people now run browsers that automatically update. Few parties are going to spend that much money just for it to only be useful for a limited number of targets. Now that Flash Player and ActiveX are pretty much gone from desktop browsers for most users, I feel the game has changed. People now need to be much more concerned with phishing, XSS, and other flaws. Social engineering is probably more of a threat to the general public than browser exploits. (I do use firejail to sandbox my Firefox instance from the rest of my machine, but that's more a layer of last defense, and doesn't really prevent too much.)
- TeMPOraL 8y ago
  Are JS-based exploits that break out and attack the OS relevant anymore? For most users, almost anything that's relevant to their lives resides within the browser anyway.
  - jchw 8y ago
    Same point remains, you still have to break the sandbox to even interfere with other websites.

jchw 8y ago

Are JS-based exploits a real threat anymore? Even if you do find an exploit, it looks to be an uphill battle, because you still have layers of security to break through, and they're going to differ by target OS and browser. Even on platforms where things are fairly predictable, like say game consoles, the exploits look complicated and are often not very reliable. Even in Firefox where the security story is still not quite as far along, I still am not really concerned about JS exploits. And most people now run browsers that automatically update. Few parties are going to spend that much money just for it to only be useful for a limited number of targets. Now that Flash Player and ActiveX are pretty much gone from desktop browsers for most users, I feel the game has changed. People now need to be much more concerned with phishing, XSS, and other flaws. Social engineering is probably more of a threat to the general public than browser exploits. (I do use firejail to sandbox my Firefox instance from the rest of my machine, but that's more a layer of last defense, and doesn't really prevent too much.)

TeMPOraL 8y ago
Are JS-based exploits that break out and attack the OS relevant anymore? For most users, almost anything that's relevant to their lives resides within the browser anyway.
- jchw 8y ago
  Same point remains, you still have to break the sandbox to even interfere with other websites.