3 ms·
>> If you have malware running with your user permissions, your entire browser can be swapped out with a hacked version that keylogs you. That's not true eithe
by phkahler 3y ago
>> If you have malware running with your user permissions, your entire browser can be swapped out with a hacked version that keylogs you.
That's not true either. The malware would require privilege escalation to co-opt my browser. Even if you weren't wrong about that, I don't know why you complain about both weak security models AND a very big improvement in Linux security (Wayland).
Oh right, on X the malware could just wait for me to type in my password for something I wanted to do and grab it. then it could sudo just like me.
- jowea 3y ago> That's not true either. The malware would require privilege escalation to co-opt my browser. Does it? Sure it can't replace /usr/bin/firefox, but what's stopping the malware from writing a fake shortcut to ~/.local/share/applications/malwarefirefox.desktop and waiting until you click the fake shortcut? Or kill the running firefox and start the malware version? Or add some malware extension directly to ~/.mozilla/firefox/profiles? Or something else? Or are you assuming the malware is running in a sandbox like AppArmor?
- mcpackieh 3y agoExactly. A program running as the user can change the user's desktop configuration to launch a hacked browser instead of the browser installed by the system. It can also edit PATH and then wrap sudo and get root access the next time you use it, or fuck with you a thousand other ways.