• 0 Posts
  • 96 Comments
Joined 1 year ago
cake
Cake day: October 5th, 2023

help-circle




  • It’s the fact that the intelligence agencies have proven themselves to be unable to responsibility use their powers, and instead find every sneaky way possible to infiltrate and spy on their own citizens while preventing nothing. That’s what has pushed the world to say enough is enough and we are going to encrypt everything we can. Now the global powers are crying poor about how they need access to stop terrorism, while being completely unable to point to a single instance where they stopped a terror attack and contrarily there’s plenty of terror attacks that were never stopped.






  • It’s not a competition to see who can commit the most war crimes. This whole idea of comparing one faction against another to see who is worse is just stupid. It should not even come into play when someone simply condemns war crimes! The fact that people read so much into a simple statement says more about them than the person who posted it. If someone’s reaction to someone saying “war crimes are war crimes even when commited by your allies” is to think “well that person is justifying Hamas’s actions” then the problem lies there, just as much as it is to think “that person is saying Israel doesn’t have a right to defend themselves”.

    All it is is making the world more divisive when it should be unifying to condemn the tragic loss of innocent human life. People should not impose their factional viewpoints on something as simple as that.





  • While this is a real issue, the threat is best mitigated outside of the browser. In theory any application you run could put contents in your primary selection, the threat is what you do with that. The biggest threats I can imagine are insecure shell settings which the author pointed out and can be mitigated easily. Or as a commenter pointed out, cryptocurrency related activities could be at risk - such as pasting in an address to send the currency to could be hijacked and you probably wouldn’t even notice as the addresses are random. X is known to be insecure and if you’re doing something sensitive like handling cryptocurrency it would be best practice not to run X anyway.


  • It would be much easier to check the settings for your shell and display server. It’s a very niche threat. Think about how having something copied into your clipboard could actually effect you? I can’t imagine too many scenarios where you would paste something malicious that would actually be a problem. Paste something malicious into an email and you could just delete it. Paste something into the URL address bar and it wouldn’t submit until you told it to. Paste something malicious into your terminal and it wouldn’t submit until you hit enter (check that last one yourself).

    Alternatively, disable javascript in the browser.


  • I 100% agree that it effects an extremely small percentage of the population, but it’s also not hard to imagine a scenario in which this can have real consequences.

    Let’s imagine I have a popular website that documents Linux tips and tricks (think: which command can I run to see drive storage used again?). In there I have a short command people can copy and paste to run (maybe df -h). The user copies this command and switches window to their terminal, at which point the blur event listener fires and I override the innocuous command with a malicious command. The user pastes it into their terminal without any indication that the primary selection content is now different.

    Yes, this is due to both insecure X and shell settings that doesn’t effect everyone (Wayland and sane shell). It’s as much or even more the fault of the insecure programs, but Firefox is a part of that. Even in this situation it would be much more likely that the user is effected compared to the “general population”. It’s more of a targeted attack than a broad insecurity, but it’s not a “one in a million” chance.




  • Yeah I do agree and myself run FDE as a defence in depth measure and as a protection against specific threats such as the one you mentioned. I think we agree on that completely.

    In saying that, I would further add that it shouldn’t be relied upon as the only defensive measure as once someone has gained physical access to the device it’s not going to protect you against targeted attacks. If someone has access to your home they could install a camera aimed at the keyboard, or a hardware keylogger, or the good ol’ $5 wrench attack.