• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Firefox 0-day in the wild is being used to attack Tor users

It would be nice if browsers would be chrooted by default when installed. It seems no one can make a secure browser these days. They have no reason to need access to the entire file system. Just need a place to store settings, bookmarks and downloads.

I looked into what it takes to chroot it but it's quite involved. Need to actually try it some day.
 
Red Squirrel said:
It would be nice if browsers would be chrooted by default when installed. It seems no one can make a secure browser these days. They have no reason to need access to the entire file system. Just need a place to store settings, bookmarks and downloads.

I looked into what it takes to chroot it but it's quite involved. Need to actually try it some day.
Click to expand...

Chrome/Chromium does everything you've mentioned.
 
Elixer said:
No, Chrome still allows access to the filesystem, there is no access control yet.

What is needed is a complete web OS that runs in an access controlled VM.
Click to expand...

The renderer and plugin processes shouldn't have access to anything. They have to go through the broker process.

On Windows they run at an untrusted integrity level which cannot access anything.
 
TheRyuu said:
The renderer and plugin processes shouldn't have access to anything. They have to go through the broker process.

On Windows they run at an untrusted integrity level which cannot access anything.
Click to expand...

Privilege escalation exploits. These things happen all the time especially in windows. What needs to happen is that browsers need to be truly sandboxed, like a VM or chroot. Suppose you could just do that yourself and run it in a VM though. There could be a network share for the bookmarks and downloads, and the VM itself is setup so to just goes back to a preset each time it's loaded. So even if it gets infected you just restart it. Idealy it would need to be fairly seamless though.
 
Red Squirrel said:
What needs to happen is that browsers need to be truly sandboxed, like a VM or chroot.
Click to expand...

Unless you're using grsecurity a chroot is not like a jail on linux. Privilege escalation's are not exclusive to Windows. They happen everywhere. That doesn't mean you should just give up and not practice defense in depth. Chrome/chromium does basically everything it can short of running in a VM. Just look at all the crap it can block with win32k lockdown enabled for Flash on Windows 10, we're talking defeating classes of exploits.

I'm pretty sure Chrome/chromium does use chroot on linux.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top