[mimimi31]

Haven't you pretty much already lost when you can't trust the programs running on your machine? If they can snoop on your clipboard, they're probably also able to access your sensitive files, log key presses, take screenshots, install browser extensions etc.

[Wowfunhappy]

They'd need root access to do half of those things. The other half are bad but not life-shattering.

[mimimi31]

This obviously depends on your OS and setup, but on Linux + Xorg at least I don't need root access to do any of the things I listed.

[Wowfunhappy]

Sorry, I must have been very tired last night. This morning, I can't remember (or figure out) which actions I was thinking of when I wrote that.

The only one that still jumps out to me is browser extensions—I'm pretty sure none of the major browsers allow that without user approval within the browser. You'd have to do something nasty which would require root.

[mimimi31]

>The only one that still jumps out to me is browser extensions—I'm pretty sure none of the major browsers allow that without user approval within the browser. You'd have to do something nasty which would require root.

I've admittedly never tried it, but as far as I understand, installing an extension in Firefox just involves copying the corresponding .xpi file to the profile folder (which is owned by the user, not root) and modifying a few configuration files (e.g. extensions.json). I don't see why some other program wouldn't be able to do that.

If root access were required, you'd have to supply your root password every time you wanted to install an extension.

[Wowfunhappy]

Nope, they don't allow that anymore! https://blog.mozilla.org/addons/2020/03/10/support-for-exten...

This is in addition to the fact that Firefox has absolutely mandatory code signing for extensions (the only recourse is to recompile Firefox). That's something I'm very much not happy about, but does have upsides.

[mimimi31]

I have a hard time imagining how they enforce that. What keeps a malicious program from replicating the exact changes that Firefox makes when installing an extension? What about just replacing the whole profile folder with one that has a malicious extension installed?

>Firefox has absolutely mandatory code signing for extensions

That helps I guess, but there are clearly still malicious extensions that can pass the automated tests and get signed. Even if that wasn't possible, you could probably use some userscript extension and load malicious scripts that way.