3 ms·
It doesn’t have the keys, but it can inject any javascript and do whatever the user can do.
by shp0ngle 4y ago
It doesn’t have the keys, but it can inject any javascript and do whatever the user can do.
- Spivak 4y agoTo me it seems they've taken all precautions they can reasonably take -- "what if the user installs a keylogger" isn't fixable by anyone.
- gunapologist99 4y ago"Installing a keylogger" is a vast oversimplification, even if it is outside of their threat model. Installing almost anything in your browser is usually a matter of a couple of clicks.
- ithkuil 4y agoLike intercepting your oauth token next time you login into SSO and then use that to access your tailnet. This was true even before this new feature. The new threat model is entirely psychological.