3 ms·

You misunderstand the security implications, so making categorical statements like that isn't useful. While random running processes may be on a developer's mac

by IncRnd 4y ago

You misunderstand the security implications, so making categorical statements like that isn't useful. While random running processes may be on a developer's machine, that's not at issue here.

vorpalhex 4y ago
/mnt is owned by root, the submount would be owned by either root or your user your cookie jar is somewhere in ~ (eg ~/.firefox) If a service has been compromised such that it can exfiltrate /mnt/blah/tab/blah/, it can also exfiltrate ~/.firefox/blah You're shuffling deck chairs on the titanic.
- IncRnd 4y ago
  You should read the article. This isn't /mnt but fs/mnt. In this particular scenario, the article describes the use of FUSE for mounting the files. FUSE stands for "Filesystem in Userspace". This, thankfully, doesn't force running a web browser as root, which would be required in your scenario.
  - vorpalhex 4y ago
    > doesn't force running a web browser as root, which would be required in your scenario. It would not in any way shape or form be required in my scenario. Please re-read the basics of file permissions on POSIX. We are asking the question: "Does this expose additional potential security vulnerabilities not exposed with the cookies existing purely in the normal cookie store?" Our possible vectors of attack are a compromised root owned service and a compromised user owned service. Both of those vectors would allow the cookie store to be exfiltrated regardless of whether this extension is used. Ergo, this extension does not create any additional security vulnerabilities in that regard.
    - deleted 4y ago
      [deleted]