3 ms·

> Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution ave

> Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion. Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. What about ads? Tracking? Apps sending fingerprinting home? That seems like a more obvious place to start.

duskwuff 3y ago
> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Malware exfiltrating users' browser sessions and passwords is a "very arbitrary threat model" that "doesn't seem to affect people"???
- diogenes4 3y ago
  Yes
mschuster91 3y ago
> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Credential stealer malware is abundant, it's often enough how attackers gain initial access to a company's internal network - grab the credentials off of Chrome, Firefox or one of the other popular password manager apps, and you're bound to find a set of credentials there. Now all you need is some piece of software that's reachable from the Internet and lacks 2FA (which applies to a shocking lot of legacy software), and you got some sort of persistent access to the network. And in ye early days of cryptocurrencies, before hardware vaults became the norm among crypto enthusiasts, a fair amount of people got their wallets drained by targeted cookie (=session) stealers. > What about ads? Tracking? Apps sending fingerprinting home? That is bad, but not "someone can drain your bank account or take over your social media accounts to spam" bad.
- diogenes4 3y ago
  I disagree; i think the proliferation of ads is a type of malware that has far more detrimental effects on society than credit card theft (which, incidentally, wouldn't be a problem if the industry bothered to protect their cards with basic authentication on use, which they refuse to)

duskwuff 3y ago

> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Malware exfiltrating users' browser sessions and passwords is a "very arbitrary threat model" that "doesn't seem to affect people"???

diogenes4 3y ago
Yes

mschuster91 3y ago

> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Credential stealer malware is abundant, it's often enough how attackers gain initial access to a company's internal network - grab the credentials off of Chrome, Firefox or one of the other popular password manager apps, and you're bound to find a set of credentials there. Now all you need is some piece of software that's reachable from the Internet and lacks 2FA (which applies to a shocking lot of legacy software), and you got some sort of persistent access to the network. And in ye early days of cryptocurrencies, before hardware vaults became the norm among crypto enthusiasts, a fair amount of people got their wallets drained by targeted cookie (=session) stealers. > What about ads? Tracking? Apps sending fingerprinting home? That is bad, but not "someone can drain your bank account or take over your social media accounts to spam" bad.

diogenes4 3y ago
I disagree; i think the proliferation of ads is a type of malware that has far more detrimental effects on society than credit card theft (which, incidentally, wouldn't be a problem if the industry bothered to protect their cards with basic authentication on use, which they refuse to)