3 ms·
Plugins and automatic security updates (or any update for what it is worth) are two biggest security holes ever. Which is why for anything really sensitive I'm
by martinced 14y ago
Plugins and automatic security updates (or any update for what it is worth) are two biggest security holes ever.
Which is why for anything really sensitive I'm booting from a live CD, giving me a system which is "read-only" and not "phoning home" to see if there are updates.
It's a pain. But less of a pain than getting root'ed / admin'ed.
Signed binaries ain't helping either: we've seen several seemingly "legit" software signed with compromised keys.
False sense of security.
- atesti 14y agoPlugins are not security holes! Sure they make it slightly more accessible to e.g. steal browser passwords, but you can always inject code into other processes to do such things.
- Armbrs 14y agoThe presence of other security holes doesn't invalidate the existence of this one.
- atesti 14y agoI really don't consider this a security hole! This does not increase privileges of the attacker: If the attacker can modify Firefox's profile directory it could also inject something into firefox or read the cookies directly.