3 ms·

If a particular feature is controlled by a permissions prompt, saying that 'users can't be expected to be fully aware of' the consequences of a particular permi

by avazhi 3y ago

If a particular feature is controlled by a permissions prompt, saying that 'users can't be expected to be fully aware of' the consequences of a particular permission edit has, once again, nothing to do with security as everybody in the world besides yourself understands that term. Criticise their UI team, perhaps, but such a problem has nothing to do with security - indeed the 'feature' might be working exactly as intended, notwithstanding the (in your view) unclear wording obscuring it. At this point I can only assume that your conflating of security and privacy is pathological, and I very much doubt that we can have a fruitful discussion about this.

soraminazuki 3y ago
Take WebMIDI, for example. A website using it would show the following permission prompt in Chrome: example.com wants to Control and reprogram your MIDI devices (SysEx) [Block] [Allow] According to you, everyone should understand that term to mean example.com can access their device to overwrite the firmware of a MIDI device, turn it into a keyboard, and take full control of the computer. It's feature working as intended and no security issues are involved. I am so glad both Apple and Mozilla doesn't subscribe to you or Google's definition of "security." These gaping security holes can cause so much damage, and to see these as "features working as intended" shows how disconnected you are with actual users. Even the infamous ActiveX would not have security issues if we redefined security under your terms. A browser should never ever include capabilities for full system compromise as one of its features. No permission prompt should ever let that happen. You also need to consider the inherent danger of exposing hardware to websites when considering whether permission prompts are adequate. Again, hardware aren't designed with the expectation that they'll be exposed to websites. Browser vendors can't possibly be aware of the security implications of doing so for every device out there either. That was one of the core arguments of my previous reply and I wish you hadn't omitted that. Unfortunately, my point about the permission prompt was taken out of context and spun into a "pathological" view that "everybody in the world besides myself" would laugh at. Lastly, you might want to actually look at the examples I posted. Some of them don't or didn't involve permission prompts and enabled attack by third parties. Which I believe to be a security issue even under your terms.

by avazhi 3y ago

soraminazuki 3y ago

Take WebMIDI, for example. A website using it would show the following permission prompt in Chrome: example.com wants to Control and reprogram your MIDI devices (SysEx) [Block] [Allow] According to you, everyone should understand that term to mean example.com can access their device to overwrite the firmware of a MIDI device, turn it into a keyboard, and take full control of the computer. It's feature working as intended and no security issues are involved. I am so glad both Apple and Mozilla doesn't subscribe to you or Google's definition of "security." These gaping security holes can cause so much damage, and to see these as "features working as intended" shows how disconnected you are with actual users. Even the infamous ActiveX would not have security issues if we redefined security under your terms. A browser should never ever include capabilities for full system compromise as one of its features. No permission prompt should ever let that happen. You also need to consider the inherent danger of exposing hardware to websites when considering whether permission prompts are adequate. Again, hardware aren't designed with the expectation that they'll be exposed to websites. Browser vendors can't possibly be aware of the security implications of doing so for every device out there either. That was one of the core arguments of my previous reply and I wish you hadn't omitted that. Unfortunately, my point about the permission prompt was taken out of context and spun into a "pathological" view that "everybody in the world besides myself" would laugh at. Lastly, you might want to actually look at the examples I posted. Some of them don't or didn't involve permission prompts and enabled attack by third parties. Which I believe to be a security issue even under your terms.