3 ms·

web apps are on servers that can be hacked. if facebook or twitter can be hacked so can b google docs or any SAAS.

• eslaught 14y ago
  Of course. But that's very different from hacking the user's own machine, which effectively provides the hacker with access to everything the user does. Hacking a single service means that you merely get access to that one service, plus anything else where the user used the same password. And we already have technologies which would make it so that hacking a service would only give access to that one service, e.g. Mozilla Persona[1]. [1]: https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/
  • kyllo 14y ago
    >plus anything else where the user used the same password Assuming the service is storing unsalted password hashes that can be cracked using a rainbow table, or (god forbid) plaintext passwords, right?
    • drivebyacct2 14y ago
      If I have compromised a server, it's pretty trivial to have login.php also POST a copy of the raw user/pass to my server if I wanted.
  • jiggy2011 14y ago
    attack vectors and techniques are different, but everything else stays the same. If one can add a <script> tag to arbitrary webpages via a malicious extension,XSS or whatever other method then that's probably as good as/better than root. You are still not magically immune from buffer overflow, heap overflows or any of the other bread and butter stuff either.