5 ms·

If a hostile party can get code onto your computer, it doesn't matter much whether the hostile code is living inside chrome.exe or some other program. If I am

If a hostile party can get code onto your computer, it doesn't matter much whether the hostile code is living inside chrome.exe or some other program. If I am quietly targeting you to get malware onto your machine to capture your key, trying to sabotage Google Updater even in the current format is the wrong way.

AnthonyMouse 12y ago
If you want to be secure against an attack you have to close all the attack vectors. If whatever the "right way" is supposed to be is patched but this method remains exploitable then you're not finished.
- danielweber 12y ago
  Trying to secure a self-updating program pulling updates from an untrusted source that it's explicitly designed to trust via its threat model is not "closing an attack vector." It's "impossible." If you think Google's update mechanism is compromised, you need to turn off automatic updates, and then only update via Chrome's offline installer after verifying checksums. Of course, the question is "compare against what?" If Google Chrome is actively hostile, it isn't going to be turned up by Joe Random decompiling every single version and inspecting all the routines. You are slightly better off if you build it yourself, but now you have opened a turtles-all-the-way rat's nest of Trusting Trust and your entire toolchain. And who are you paying to review google's source code against accidental memory leakage each time a new version comes out? If Google is hostile against you, you shouldn't even be using their browser in any way.
  - AnthonyMouse 12y ago
    > If Google is hostile against you, you shouldn't even be using their browser in any way. The problem with this statement is that it generalizes. Unless your solution is to not use any browser, you have to trust somebody. The traditional way to solve this problem is checks and balances. You don't trust just Google, you make them show their work. Because if the source code is sitting there on the web for everybody to see it, and anyone can verify that the binary being distributed to everyone matches the one they get when they compile it themselves, inserting a backdoor is a lot more dangerous because of the risk that you get caught and ruin your reputation. But for any of that to be possible, the code running on your computer has to be the same as the code running on everybody else's computer. The fact that somebody could inspect the code that isn't running on your computer does you no good.

AnthonyMouse 12y ago

If you want to be secure against an attack you have to close all the attack vectors. If whatever the "right way" is supposed to be is patched but this method remains exploitable then you're not finished.

danielweber 12y ago
Trying to secure a self-updating program pulling updates from an untrusted source that it's explicitly designed to trust via its threat model is not "closing an attack vector." It's "impossible." If you think Google's update mechanism is compromised, you need to turn off automatic updates, and then only update via Chrome's offline installer after verifying checksums. Of course, the question is "compare against what?" If Google Chrome is actively hostile, it isn't going to be turned up by Joe Random decompiling every single version and inspecting all the routines. You are slightly better off if you build it yourself, but now you have opened a turtles-all-the-way rat's nest of Trusting Trust and your entire toolchain. And who are you paying to review google's source code against accidental memory leakage each time a new version comes out? If Google is hostile against you, you shouldn't even be using their browser in any way.
- AnthonyMouse 12y ago
  > If Google is hostile against you, you shouldn't even be using their browser in any way. The problem with this statement is that it generalizes. Unless your solution is to not use any browser, you have to trust somebody. The traditional way to solve this problem is checks and balances. You don't trust just Google, you make them show their work. Because if the source code is sitting there on the web for everybody to see it, and anyone can verify that the binary being distributed to everyone matches the one they get when they compile it themselves, inserting a backdoor is a lot more dangerous because of the risk that you get caught and ruin your reputation. But for any of that to be possible, the code running on your computer has to be the same as the code running on everybody else's computer. The fact that somebody could inspect the code that isn't running on your computer does you no good.