Threads for ponguile
-
What are the security implications?
-
-
Thanks for this! I appreciate emphasizing the overarching data architecture rather than the lower level programming paradigms used to implement the abstractions.
-
Thanks for this!
-
Wow, AI is getting real good, real fast.
Uhhh…
Beware companies claiming they do something for the security of their users when it also affects their bottom line. Security, “anti-hijacking” and related terms are often used manipulatively (especially in EULAs!).
Restricting browser defaults choice is not an effective security feature for protecting user security or privacy:
Making it harder for users to change browser (and directly suggesting they do not do it with a little info box when they try, as Win10 does) is an effective method of enforcing market security. That’s not user security.
You start to get a sense of manipulation when you read Microsoft’s statements about edge and privacy::
That’s straight out false. Not “all modern browsers” send information like “browsing history” to their makers. Notice how they have designed this sentence to make it feel normal and acceptable.
Uhuh. Is that the only reason you share data? Somehow you must be making money off this, otherwise you wouldn’t be doing it, right?
https://privacy.microsoft.com/en-ca/privacystatement
Manipulative writing by business’ like this makes me ill. In a different content (eg flyers in your letterbox) this style of writing would be considered scam material.
Microsoft and anti-competitive practises go hand in hand, nothing to be surprised about.
Was more concerned about the obvious security implications! If ff can do it, what is stopping malware from doing it?
Likewise if Edge can bypass the mechanisms in the background, what’s stopping malware from doing it? Or apparently Firefox 😆😭
Yep. I’m in a slightly weird position here: I think Microsoft is right to lock down that API; I just think they’re wrong for unlocking it for Edge. So I’d prefer neither Mozilla nor Edge could pull this stunt.
Theoretically the mechanism could check that the software performing the bypass comes from microsoft (via cryptographic signature) and is therefore “safe”. It is possible for microsoft to allow Edge to bypass it and nothing else.
I’m actually sort of surprised they didn’t, but I guess doing it properly would have taken more work.
Or perhaps it was a silent protest by the engineers involved to allow firefox to do this.
Nothing, of course, which isn’t too surprising, as this is pretty unlikely to have ever been about malware in the first place. If it had been, we’d have seen a real, secure API exposed to developers, whereas this is barely security by obscurity.
Nothing is stopping malware engineers from adding associations; SetUserFTA has been available for years.