Re: Iceweasel updates

From	Brian <ad44@cityscape.co.uk>
Newsgroups	linux.debian.user
Subject	Re: Iceweasel updates
Date	2015-11-03 00:00 +0100
Message-ID	<qqwf0-2M7-15@gated-at.bofh.it> (permalink)
References	(4 earlier) <qqnbI-5Ml-11@gated-at.bofh.it> <qqnEJ-5VS-1@gated-at.bofh.it> <qqnOq-5Zc-1@gated-at.bofh.it> <qqoU9-6R3-3@gated-at.bofh.it> <qqvsC-2u9-19@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon 02 Nov 2015 at 23:02:38 +0100, Vincent Lefevre wrote:

> On 2015-11-02 15:00:19 +0000, Brian wrote:
> > On Mon 02 Nov 2015 at 14:58:24 +0100, Vincent Lefevre wrote:
> > 
> > > On 2015-11-02 13:47:41 +0000, Brian wrote:
> > > > On Mon 02 Nov 2015 at 14:17:39 +0100, Vincent Lefevre wrote:
> > > > > The user's browser cannot compromise the site itself. But a security
> > > > > bug may permit an attacker to get the user's login and password, and
> > > > > neither the bank nor the user would like this.
> > > > 
> > > > Would this obtaining of the password be before or after encryption
> > > > takes place?
> > > 
> > > With an XSS[*] vulnerability, before.
> > > 
> > > [*] https://en.wikipedia.org/wiki/Cross-site_scripting
> > 
> > Quoting from that page:
> > 
> >   XSS enables attackers to inject client-side script into web pages
> >   viewed by other users.
> > 
> > The bank's site would be compromised. It wouldn't matter what user-agent
> > string was sent by the user.
> 
> No, the injection happens locally (after the web page is fetched),
> in the user's browser, not remotely.

An attacker must inject a payload into a web page that the user visits.
When the page loads in the user’s browser the attacker’s payload will
be executed. A user would likely have no knowledge of this, irrespective
of whatever browser or user-agent string is being used.

Without the payload (which the bank's site has delivered) the security
of the browser is not compromised. If a password were to be obtained the
bank is complicit in the action. I expect they would take responsibilty
for this.

Thread

Iceweasel updates Jack Dangler <tdldev@gmail.com> - 2015-11-02 13:30 +0100
  Re: Iceweasel updates Brad Rogers <brad@fineby.me.uk> - 2015-11-02 13:40 +0100
    Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 13:50 +0100
      Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:10 +0100
        Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:20 +0100
          Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:50 +0100
            Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 15:00 +0100
              Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 16:10 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 23:10 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-03 00:00 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-03 03:00 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-03 15:00 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-04 15:00 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-04 21:00 +0100
                Re: Iceweasel updates Joe <joe@jretrading.com> - 2015-11-03 09:30 +0100
                Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 11:10 +0100
                Re: Iceweasel updates David Wright <deblis@lionunicorn.co.uk> - 2015-11-03 15:30 +0100
  Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:00 +0100
  Re: Iceweasel updates Alex Moonshine <moonshine@openmailbox.org> - 2015-11-02 14:20 +0100
    Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:30 +0100
      Re: Iceweasel updates Alex Moonshine <moonshine@openmailbox.org> - 2015-11-02 15:20 +0100
        Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 05:40 +0100
    Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:40 +0100
  Re: Iceweasel updates Gene Heskett <gheskett@shentel.net> - 2015-11-02 14:40 +0100
    Re: Iceweasel updates John Hasler <jhasler@newsguy.com> - 2015-11-02 15:10 +0100
      Re: Iceweasel updates Charlie Kravetz <cjk@teamcharliesangels.com> - 2015-11-02 15:30 +0100
        Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 15:40 +0100
          Re: Iceweasel updates Lisi Reisz <lisi.reisz@gmail.com> - 2015-11-02 16:20 +0100
        Re: Iceweasel updates Markus Schönhaber <debian-user@list-post.mks-mail.de> - 2015-11-02 15:40 +0100
        Re: Iceweasel updates Jack Dangler <tdldev@gmail.com> - 2015-11-02 17:50 +0100
          Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 19:00 +0100
  Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 05:30 +0100

csiph-web