3 ms·
> Are you suggesting that privilege-escalation attacks are not security risks? Nope. What I'm suggesting is that threat modelling is important. If attack vecto
by lucideer 3y ago
> Are you suggesting that privilege-escalation attacks are not security risks?
Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. Kiosk bypass might be vaguely categorisable alongside things like polkit exploits but they are not equivalent in any normal threat model.
- gfodor 3y agoNo, you said they are 'unrelated to security.' Just admit you made a mischaracterization. It happens.
- grayhatter 3y agoI agree with lucideer here. While I think the language chosen needlessly leaves space for pedantic arguments. They're correct that, from the context of google's software, none of these are relevant to the security that Google needs to care about. it's true they could be a part of the things security needs to care about, but so is a phone catching on fire because of its battery. which in of itself is not directly a security risk.
- NovemberWhiskey 3y ago>Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. OK, so we agree that, your original statement (which follows) is wrong, because it makes broad, tacit assumptions about the threat model that are not justified? Security is a field related to protecting device-users from malicious actors. Whereas a more conventional definition of information security would also involve protecting systems from unauthorized access, including privilege escalations (that's the E in STRIDE, right?) that bypass controls that were intended to apply to the user. Honestly, it's baffling to me why you're arguing this point.