Hacker News new | ask | show | jobs
by cpburns2009 3026 days ago
It's almost as if browsers are slowing reinventing Java applets while ignoring all of the security implications that go along with it.
2 comments

They're slowly inventing operating systems, complete with hypervisor technology, with all the gargantuan complexity that it implies, to please big business that wants the client OS to essentially become obsolete.
The web browsers are so much more secure than what we had before (just accepting executable binaries from other people), so I look at this as a way forward.
I'm not that confident. Browsers blindly accept and execute whatever they receive. The more features that get added, the larger surface there is to exploit. A case in point: WebUSB as mentioned in the article.
The nice thing though is that, although the added attack surface is there, its not really accessible to web pages until a user grants the necessary permissions. Not really all that different from telling users to execute a native app in that respect.

In this case it's not even an exploit really; more like social engineering. (Tricking users into granting the phishing site unrestricted access to their Yubikey, then using that access to trick the user into authenticating a login session for the phishing site.)

Imageine if there is an USB device with new Chrome WebUSB driver (which has necessary permissions) and then vendor's website gets hacked.
A browser is more secure than a linux namespace with SELinux rules that require explicit approval for any access?

A browser is more secure than Qubes?

The flaw is in legacy software, not in what is possible. Had humanity spent the effort that was spent on browsers on operating systems instead, we'd have had the same security improvements without all the negatives.

And yet, at quick glance, Chromium THREE TIMES more CVEs than the Java JRE...so it might be more secure than before, but lets not celebrate just yet!
When I see a shady link, I open it in a browser inside my virtual machine. I've had attacks on firefox that straight executed a binary on my machine, without me doing anything but clicking a link.
But if we ever stopped adding features, things might start working as intended.