Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #160168

Re: Iceweasel updates

Show all headers | View raw

On Tue 03 Nov 2015 at 02:57:47 +0100, Vincent Lefevre wrote:

> On 2015-11-02 22:53:03 +0000, Brian wrote:
> > An attacker must inject a payload into a web page that the user visits.
> > When the page loads in the user’s browser the attacker’s payload will
> > be executed. A user would likely have no knowledge of this, irrespective
> > of whatever browser or user-agent string is being used.
> > 
> > Without the payload (which the bank's site has delivered) the security
> > of the browser is not compromised. If a password were to be obtained the
> > bank is complicit in the action. I expect they would take responsibilty
> > for this.
> 
> If the attack is due to a vulnerability in the user's browser and
> this browser is blocked by the bank because it is old and no longer
> maintained (thus may have known, unfixed vulnerabilities), the user
> would be fully responsible. Actually it is the responsibility of
> the user to update his software, but bypassing the bank's security
> mechanisms makes him even more responsible.

The contention is that overriding a bank security decision and altering
the user-agent string is unwise and not to be recommended.

Access to digital banking at RBS and Natwest in the UK is allowed only
when the string "Firefox" is found. Many years ago I used to add it
myself to what Iceweasel sent. Nowadays there is no need to do that
because "Firefox" has been added to the user-agent in the Iceweasel
package (bug #399633).

Who is now responsible for bypassing these banks security mechanisms?
Should a user remove "Firefox" from the user-agent to protect himself
and comply with the supported browser policy of the banks?

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Iceweasel updates Jack Dangler <tdldev@gmail.com> - 2015-11-02 13:30 +0100
  Re: Iceweasel updates Brad Rogers <brad@fineby.me.uk> - 2015-11-02 13:40 +0100
    Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 13:50 +0100
      Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:10 +0100
        Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:20 +0100
          Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:50 +0100
            Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 15:00 +0100
              Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 16:10 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 23:10 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-03 00:00 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-03 03:00 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-03 15:00 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-04 15:00 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-04 21:00 +0100
                Re: Iceweasel updates Joe <joe@jretrading.com> - 2015-11-03 09:30 +0100
                Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 11:10 +0100
                Re: Iceweasel updates David Wright <deblis@lionunicorn.co.uk> - 2015-11-03 15:30 +0100
  Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:00 +0100
  Re: Iceweasel updates Alex Moonshine <moonshine@openmailbox.org> - 2015-11-02 14:20 +0100
    Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:30 +0100
      Re: Iceweasel updates Alex Moonshine <moonshine@openmailbox.org> - 2015-11-02 15:20 +0100
        Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 05:40 +0100
    Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:40 +0100
  Re: Iceweasel updates Gene Heskett <gheskett@shentel.net> - 2015-11-02 14:40 +0100
    Re: Iceweasel updates John Hasler <jhasler@newsguy.com> - 2015-11-02 15:10 +0100
      Re: Iceweasel updates Charlie Kravetz <cjk@teamcharliesangels.com> - 2015-11-02 15:30 +0100
        Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 15:40 +0100
          Re: Iceweasel updates Lisi Reisz <lisi.reisz@gmail.com> - 2015-11-02 16:20 +0100
        Re: Iceweasel updates Markus Schönhaber <debian-user@list-post.mks-mail.de> - 2015-11-02 15:40 +0100
        Re: Iceweasel updates Jack Dangler <tdldev@gmail.com> - 2015-11-02 17:50 +0100
          Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 19:00 +0100
  Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 05:30 +0100

csiph-web