4 ms·

If "whatever they switch to" is ChromeOS + web apps, then it's going to be much more expensive to get past a Chrome sandbox than any of the current exploitation

If "whatever they switch to" is ChromeOS + web apps, then it's going to be much more expensive to get past a Chrome sandbox than any of the current exploitation favorites. Sure, it's not impossible, but at least making exploitation more expensive will put the little guys out of business. And Google has sufficient money to throw at Chrome security that it will become more expensive over time, not less.

camus 14y ago
web apps are on servers that can be hacked. if facebook or twitter can be hacked so can b google docs or any SAAS.
- eslaught 14y ago
  Of course. But that's very different from hacking the user's own machine, which effectively provides the hacker with access to everything the user does. Hacking a single service means that you merely get access to that one service, plus anything else where the user used the same password. And we already have technologies which would make it so that hacking a service would only give access to that one service, e.g. Mozilla Persona[1]. [1]: https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/
  - kyllo 14y ago
    >plus anything else where the user used the same password Assuming the service is storing unsalted password hashes that can be cracked using a rainbow table, or (god forbid) plaintext passwords, right?
    - drivebyacct2 14y ago
      If I have compromised a server, it's pretty trivial to have login.php also POST a copy of the raw user/pass to my server if I wanted.
  - jiggy2011 14y ago
    attack vectors and techniques are different, but everything else stays the same. If one can add a <script> tag to arbitrary webpages via a malicious extension,XSS or whatever other method then that's probably as good as/better than root. You are still not magically immune from buffer overflow, heap overflows or any of the other bread and butter stuff either.

camus 14y ago

web apps are on servers that can be hacked. if facebook or twitter can be hacked so can b google docs or any SAAS.

eslaught 14y ago
Of course. But that's very different from hacking the user's own machine, which effectively provides the hacker with access to everything the user does. Hacking a single service means that you merely get access to that one service, plus anything else where the user used the same password. And we already have technologies which would make it so that hacking a service would only give access to that one service, e.g. Mozilla Persona[1]. [1]: https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/
- kyllo 14y ago
  >plus anything else where the user used the same password Assuming the service is storing unsalted password hashes that can be cracked using a rainbow table, or (god forbid) plaintext passwords, right?
  - drivebyacct2 14y ago
    If I have compromised a server, it's pretty trivial to have login.php also POST a copy of the raw user/pass to my server if I wanted.
- jiggy2011 14y ago
  attack vectors and techniques are different, but everything else stays the same. If one can add a <script> tag to arbitrary webpages via a malicious extension,XSS or whatever other method then that's probably as good as/better than root. You are still not magically immune from buffer overflow, heap overflows or any of the other bread and butter stuff either.