2 ms·
Maybe it's just me, but I consider this a (serious) security issue as well. The contents of temp files, which Firefox shouldn't even have access to, will now fl
by gizmo 17y ago
Maybe it's just me, but I consider this a (serious) security issue as well. The contents of temp files, which Firefox shouldn't even have access to, will now float around in the process memory of Firefox, even after the memory has been deallocated.
Firefox should never, ever, ever, open any file outside its own app directory, user preferences directory, or cache directory.
And a reasonably secure OS shouldn't even allow Firefox to open any of those files.
- teilo 17y agoNot necessarily. If this is a typical seeding algorithm, at most there would be one block of data in memory, used for hashing. And one would also think they are smart enough to zero it out before deallocating it. It IS a security library, after all.
- __david__ 17y agoIf the files are really that important shouldn't they have good permissions set? That is, if "Firefox shouldn't even have access to" them, shouldn't that be enforced by some OS level permissions? And shouldn't any other programs one has around not be writing confidential information to temp files in the first place? Seems like more of a dumb bug to me than a security problem.