lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Aug 2015 19:03:33 +0200
From: Christoph Gruber <list@...u.at>
To: bugtraq@...urityfocus.com
Subject: Re: [FD] Mozilla extensions: a security nightmare

Reindl Harald <h.reindl@...lounge.net> wrote:
> 
> that's all fine but
> 
> * nothing new, independent of lightning

ACK

> * how do you imagine a restricted user install a extension otherwise

Real sandboxing, if not possible, give the users the possibility to activate admin-installed extension, and not the possibility to install every shit which comes with a "I am free" or "I am sexy" tag.

> * and no - he must not do that is not a acceptable solution

Yes it is.

> security and usability are always a tradeoff

Not always, and if, sometimes security has to win.

> hence the topic *is* nonsense

No, it is not

Just my 4 cent

-- 
Christoph Gruber

Powered by blists - more mailing lists