3 ms·
> It’s a total non issue for the majority of folks People said the _exact_ same thing about Spectre/Meltdown. Then the JS PoCs came out
by switch007 3y ago
> It’s a total non issue for the majority of folks
People said the _exact_ same thing about Spectre/Meltdown. Then the JS PoCs came out
- Aaargh20318 3y agoIsn't the lesson here that scripting in the browser needs to die. Letting untrusted code run on your computer is always a bad idea, no matter how much you try to sandbox it.
- deleted 3y ago[deleted]
- threeseed 3y agoI would also love to see the API surface of the browser come way down. If people knew just how widespread and effective browser fingerprinting is they would be shocked. It's Cambridge Analytica on steroids.
- Dalewyn 3y agoThe SpectreMeltdown mitigations have caused me more grief than the problem themselves to this day. These vulnerabilities definitely exist, that much is a matter of fact. But whether it's something someone should consider in their threat model is a different matter.
- acdha 3y agoYes, and now browsers have mitigations which make timing attacks harder. This bug also has a key dependency on being able to trigger a crypto operation in a local process, which isn’t easy to do from a browser sandbox or in general on a Mac. The angle I’d worry about is something like a password manager, but most of those already have an authentication step and I’d be surprised if they didn’t have rate-limiting.