On Fri, Jan 19, 2018 at 12:24 PM, Carsten Pfeiffer <[email protected]> wrote:
> Am Freitag, 19. Januar 2018, 15:30:25 CET schrieb Volker Krause: > Hi, > > > Here are some thoughts on threat models for this, as a possible way to > > better capture what we want to achieve. > > that's a good start! > > I'd like to add > > 6) Rogue local software > > Assume you run any kind of software not coming from a trusted source (your > distribution). E.g. you clone a github repo and run the code. That code may > pull in further untrusted dependencies (maven, node, ...). It should be > easy > to protect your personal data, kwallets, browser history, etc. and local > network from that code. > > Possible counter-measures: easy and configurable sandboxing > > Thanks > Carsten > On just this "rogue code" see this enjoyable post: https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 Valorie -- http://about.me/valoriez
