3 ms·
I was pretty skeptical of that particular example anyway. If a user is opening random files from untrusted sources, security has already gone out the window.
by notJim 13y ago
I was pretty skeptical of that particular example anyway. If a user is opening random files from untrusted sources, security has already gone out the window.
- jakub_g 13y agoWell on a mass scale you're right, but if you're targeting a particular person X, you may create a throwaway gmail account impersonating X's friend Y, and send an innocuously looking pdf/doc/xls/lolcat gif as an attachment. IMO lots of people may fall prey to this kind of attack if the email looks legit.
- logicallee 13y agoare you kidding? there's a huge difference between parsing a document with a program you've already trusted and installed, and running an executable. your web browser literally downloads and parses documents all day long. pdf and .doc files might be marginally less secure, but they're by no means supposed to be executable. if windows refuses to display the correct extension, I suppose you have to manually open them from whatever you want to view them with (File|Open) after downloading them to a certain folder. I'd have zero qualms about doing this with a .txt file on windows for example - wouldn't you?