If your home directory is readable or writable by anyone other than you, you're compromised in a dozen more important ways, even though this is of very high imp

If your home directory is readable or writable by anyone other than you, you're compromised in a dozen more important ways, even though this is of very high importance. Your home directory's security is an axiom. It's not true, no, in the same way that there were once upon a time remote exploitable worms in major http frameworks but we don't question that a webserver doesn't allow remote-code-execution - it's the wrong layer of abstraction. Even encrypting the browser's data store at the application level is misguided and probably pointless - Anything that can read the browser's files is going to read the encryption key just as well . Anything that can read the browser's files when running as you is probably going to pop up an identical looking "Enter Password" prompt and will have the right timing and permissions to enter it into the browser once it's been leaked. Gui frameworks are not designed to protect the user from malicious applications. Android actually handles this much better - Applications (Rather, developers) are given their own user id, and so separation of files between apps is enforced at the OS level. Some level of this is why everyone has moved to Docker on the server, too.