3 ms·
Because that's an unrealistic threat model for most users.
by junon 6y ago
Because that's an unrealistic threat model for most users.
- deleted 6y ago[deleted]
- ipsin 6y agoI think the most realistic threat model right now is "subverted browser extension", which is effectively equivalent to internet-wide XSS. Luckily I've only been hit once, and with adware, but it's a risk.
- junon 6y agoA browser extension is not a threat model, I'm not sure what you mean.
- klyrs 6y agoBrowser extensions are an attack surface, examination of which is a key aspect of threat modeling.
- krageon 6y agoIt depends on whether or not your threat model includes threats likely to exploit this attack surface. I'm assuming this is why GP said that a browser extension isn't a threat model.