[Clueless anti-s]ecurity quote of the week [LWN.net]

[Clueless anti-s]ecurity quote of the week

Posted Jun 13, 2015 0:50 UTC (Sat) by Rudd-O (guest, #61155)
In reply to: [Clueless anti-s]ecurity quote of the week by jschrod
Parent article: Security quote of the week

Actually, it's not like telnet. It's worse. You posting your site with your pictures but no HTTPS enables anyone -- who positions themselves between your site and your viewers' browsers -- to run arbitrary, malicious computer programs on the computers of your viewers. This is, in fact, how the NSA deploys FOXFIRE and many other race-to-response browser exploits. So you are right, not like telnet, but much worse, with you / your dinky little website enabling those attacks.

to post comments

[Clueless anti-s]ecurity quote of the week

Posted Jun 19, 2015 16:55 UTC (Fri) by flussence (guest, #85566) [Link]

>So you are right, not like telnet, but much worse, with you / your dinky little website enabling those attacks.

No, it's the web browser that enables those attacks by silently executing arbitrary code with network access by default, without seeking the user's permission informed or otherwise, or offering reasonable access controls, and furthermore encouraging a culture of development where this kind of blatant insecurity is the social norm.