5 ms·

In this case the “user” is in part the person granting controlled access. The person moving the mouse is not the user in total. Take a easier example an atm m

In this case the “user” is in part the person granting controlled access. The person moving the mouse is not the user in total. Take a easier example an atm machine. If a person touching it can access accounts/remove money, there is no question about it being a security problem.

Ajedi32 3y ago
Yeah, it's important to make a distinction between the "user" and the device owner. Often those are the same person but not always. Treating the user as an adversary can be okay in some circumstances, but treating the device owner as an adversary is never acceptable in my opinion.
- mlyle 3y ago
  The whole problem with security is that it's often difficult to tell whether all steps of what are happening now align with the device owner's true intent-- * Is it the device owner providing the direction to do this? * Will the input being consumed as a result of this direction result in actions that the device owner approves of? etc. A kind of blanket assumption that everyone and everything is the adversary is a good starting point. The system needs to protect itself, in order to be able to faithfully follow the owner's instructions in the future.
Dylan16807 3y ago
Someone on an ATM accessing accounts other than their own is a security problem. Someone on an ATM accessing youtube is not a security problem.
- autoexec 3y ago
  I'm not so sure. It could be considered a DoS if nothing else, and throwing porn up on an ATM screen could certainly cause a company enough problems that they would consider it a security problem, and if you can load youtube on an ATM you could probably also load a different site with a fake ATM screen that collects pins and/or other personal information (account numbers would be more difficult unless you have a way to access the card reader) but any full featured browser in an ATM capable of being instructed by an attacker to load the attacker's JS is very likely a major security issue waiting to happen.
- nomel 3y ago
  Being able to display whatever you want on an ATM machine is absolutely a security problem. I could put a fake PIN prompt, a prompt to enter the card number because the reader is broken, whatever. This comment sections is blowing my mind, and is a great example of why dedicated security teams are required, in the world of software.
  - Dylan16807 3y ago
    You're assuming they have control of a lot of the screen, and that they have access to the keypad. Or even that they can get to sites other than youtube. Please don't assume the case that makes my post the weakest. Your mind is blown because you're reading way too much into my hypothetical.
    - nomel 3y ago
      > Or even that they can get to sites other than YouTube. Playing a video directing the user to call a number would be enough to trick some people. Enabling social engineering is a security problem. Security is minding the specifics, which requires not assuming things are ok. That's why red teams exist, and why the default assumption of "it's not ok" is the correct assumption. ;) We'll find out if the specific case in the article is a problem or not, once people look at it very closely. We may not have this luxury with our hypothetical ATM, though.
      - Dylan16807 3y ago
        I'm not here to make assumptions. I'm here to point out "being able to open a web page in a context like that is not necessarily a security problem", and I'm sure you can think of an example if you don't like my example. With an existence proof, you only have to worry about the narrowest possible interpretation. The skill of considering what an exploit could lead to is very important, but it fits oddly into such a hypothetical. Finding a possible flaw doesn't invalidate an existence proof unless you also can't think of a way to mitigate it. Also if the video is small and says youtube and tricks a user I'm not sure I would call that a security problem. You can trick users with a post-it note, and that doesn't mean there's anything wrong on a technical level.

Ajedi32 3y ago

Yeah, it's important to make a distinction between the "user" and the device owner. Often those are the same person but not always. Treating the user as an adversary can be okay in some circumstances, but treating the device owner as an adversary is never acceptable in my opinion.

mlyle 3y ago
The whole problem with security is that it's often difficult to tell whether all steps of what are happening now align with the device owner's true intent-- * Is it the device owner providing the direction to do this? * Will the input being consumed as a result of this direction result in actions that the device owner approves of? etc. A kind of blanket assumption that everyone and everything is the adversary is a good starting point. The system needs to protect itself, in order to be able to faithfully follow the owner's instructions in the future.

Dylan16807 3y ago

Someone on an ATM accessing accounts other than their own is a security problem. Someone on an ATM accessing youtube is not a security problem.

autoexec 3y ago
I'm not so sure. It could be considered a DoS if nothing else, and throwing porn up on an ATM screen could certainly cause a company enough problems that they would consider it a security problem, and if you can load youtube on an ATM you could probably also load a different site with a fake ATM screen that collects pins and/or other personal information (account numbers would be more difficult unless you have a way to access the card reader) but any full featured browser in an ATM capable of being instructed by an attacker to load the attacker's JS is very likely a major security issue waiting to happen.
nomel 3y ago
Being able to display whatever you want on an ATM machine is absolutely a security problem. I could put a fake PIN prompt, a prompt to enter the card number because the reader is broken, whatever. This comment sections is blowing my mind, and is a great example of why dedicated security teams are required, in the world of software.
- Dylan16807 3y ago
  You're assuming they have control of a lot of the screen, and that they have access to the keypad. Or even that they can get to sites other than youtube. Please don't assume the case that makes my post the weakest. Your mind is blown because you're reading way too much into my hypothetical.
  - nomel 3y ago
    > Or even that they can get to sites other than YouTube. Playing a video directing the user to call a number would be enough to trick some people. Enabling social engineering is a security problem. Security is minding the specifics, which requires not assuming things are ok. That's why red teams exist, and why the default assumption of "it's not ok" is the correct assumption. ;) We'll find out if the specific case in the article is a problem or not, once people look at it very closely. We may not have this luxury with our hypothetical ATM, though.
    - Dylan16807 3y ago
      I'm not here to make assumptions. I'm here to point out "being able to open a web page in a context like that is not necessarily a security problem", and I'm sure you can think of an example if you don't like my example. With an existence proof, you only have to worry about the narrowest possible interpretation. The skill of considering what an exploit could lead to is very important, but it fits oddly into such a hypothetical. Finding a possible flaw doesn't invalidate an existence proof unless you also can't think of a way to mitigate it. Also if the video is small and says youtube and tricks a user I'm not sure I would call that a security problem. You can trick users with a post-it note, and that doesn't mean there's anything wrong on a technical level.