2 ms·
> the code running behind EMEs is an unaudited, black box It's an unaudited black box that isn't running in the same process as the browser itself. It can cert
by shadowgovt 4y ago
> the code running behind EMEs is an unaudited, black box
It's an unaudited black box that isn't running in the same process as the browser itself. It can certainly do risky things in that context, but one of those things isn't "scrape the user's bank password directly out of the RAM it's sharing with the tab showing the bank's web site."
- mmastrac 4y agoI'm not going to defend plugins as they were (a plugin-based DRM solution would not necessarily rely on the <embed> tags), but they were migrating to run in sandboxes before flash died. Chrome shipped flash-as-locked-down-process from early in its history. EME code, however, can have deep hooks into the OS, especially on mobile.