5 ms·

Could this be used as an argument for allowing iOS to support other browser engines?

• jmull 5y ago
  Not a lot. It's almost a wash. Let's say another engine takes half the market. Now you've got twice the attack surface , but the vulnerable population is half as large for each. But some attacks are only worth it if the pool of vulnerable devices is large enough. So the fragmentation helps, bust mostly for lower stakes attacks.
  • deregulateMed 5y ago
    "Security" - Apple Commercials I suppose to give them credit, putting a white word on a black background is enough plausible deniability.
  • j16sdiz 5y ago
    > So the fragmentation helps, bust mostly for lower stakes attacks. fragmentation make keeping all variant up-to-date much harder.
• twobitshifter 5y ago
  More browsers = More exploits. An attacker may not know which browser you use, but the linked site could contain multiple exploits to cover more than one browser. Also, this exploit didn't even escape the IOS sandbox. Instead it was exfiltrating active logins to social networking / email sites. The weakness is that attackers were able to violate the same-origin policy and that allowed them to read those cookies from a malicious site. It says that these attackers are mitigated by 'site-isolation' which is in chrome and firefox. Hopefully Safari will add similar capabilities soon.