3 ms·
> A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. A browser
by jfrunyon 6y ago
> A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste.
A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.
- cutemonster 6y agoDifferent types of vulnerabilities, not that much comparable
- jjav 6y ago> A browser is too complex but an OS and SSH aren't? Yes, most certainly. A browser is running adversarial third party code all the time as a matter of course. While browsers do a good job at isolating, expecting this to be perfect is way too fragile for a security critical requirement like putting all passwords in one basket. An isolated and minimized OS install, much easier to harden. Never runs any code you don't know about.