3 ms·

> Chrome and Firefox's sandboxes, meanwhile, are both open-source. You can inspect what powers the EME module might possibly have, and know that it can't gain a

> Chrome and Firefox's sandboxes, meanwhile, are both open-source. You can inspect what powers the EME module might possibly have, and know that it can't gain any more. Yeah, that's not true[1]. Sandbox security is not perfect. Sandboxed plugins are definitely are an improvement in security over non-sandboxed ones, but running untrusted code in a sandbox is still running untrusted code on your machine. At the very least that has to be considered one level of privilege escalation that's just being handed to malicious coders for free. Sandboxes are great. I'd love to see open source code run inside sandboxes, because even if the code has been audited, because even if I know the code isn't trying to do anything bad, it might have vulnerabilities that let other people do bad things. Running closed-source EME code inside a sandbox is still an unnecessary risk, though, because we have no way of verifying whether that code is secure and in fact that code might be an attacker itself. [1] http://www.zdnet.com/article/pwn2own-2012-google-chrome-browser-sandbox-first-to-fall/ http://www.zdnet.com/article/pwn2own-2012-google-chrome-brow...

vertex-four 12y ago
> running untrusted code in a sandbox is still running untrusted code on your machine asm.js and various obfuscators allow websites to do this in the first place with closed-source code, with a far larger attack service than the EME sandbox. In not a lot of time from now, they quite reasonably could.
comex 12y ago
The JavaScript VM is also a type of sandbox, whose security in every browser is compromised on a depressingly regular schedule. It's true that the EME sandbox is an additional risk, but it's only supposed to run a single piece of software from (in Firefox's case) Adobe, which is probably not malware, and would thus have to be exploited before the strength of the sandbox made a difference. It probably can be exploited, but considering that attackers can run arbitrary evil JavaScript directly... EME is only a small addition to the overall risk profile. What I think is more important, from a security perspective, is that EME defeats (or attempts to defeat) attempts to get by without JavaScript or the complexity of modern browsers altogether. YouTube doesn't work as is without JavaScript anyway, but one determined not to use it could just download all their videos with youtube-dl; until someone comes out with a reverse engineered Widevine or Adobe Primetime or whatever other long-i-festooned DRM systems these sites support, this plan won't work for DRMed video.

vertex-four 12y ago

> running untrusted code in a sandbox is still running untrusted code on your machine asm.js and various obfuscators allow websites to do this in the first place with closed-source code, with a far larger attack service than the EME sandbox. In not a lot of time from now, they quite reasonably could.

comex 12y ago

The JavaScript VM is also a type of sandbox, whose security in every browser is compromised on a depressingly regular schedule. It's true that the EME sandbox is an additional risk, but it's only supposed to run a single piece of software from (in Firefox's case) Adobe, which is probably not malware, and would thus have to be exploited before the strength of the sandbox made a difference. It probably can be exploited, but considering that attackers can run arbitrary evil JavaScript directly... EME is only a small addition to the overall risk profile. What I think is more important, from a security perspective, is that EME defeats (or attempts to defeat) attempts to get by without JavaScript or the complexity of modern browsers altogether. YouTube doesn't work as is without JavaScript anyway, but one determined not to use it could just download all their videos with youtube-dl; until someone comes out with a reverse engineered Widevine or Adobe Primetime or whatever other long-i-festooned DRM systems these sites support, this plan won't work for DRMed video.