Re: Iceweasel updates

From	Vincent Lefevre <vincent@vinc17.net>
Newsgroups	linux.debian.user
Subject	Re: Iceweasel updates
Date	2015-11-03 03:00 +0100
Message-ID	<qqz3c-4xe-11@gated-at.bofh.it> (permalink)
References	(5 earlier) <qqnEJ-5VS-1@gated-at.bofh.it> <qqnOq-5Zc-1@gated-at.bofh.it> <qqoU9-6R3-3@gated-at.bofh.it> <qqvsC-2u9-19@gated-at.bofh.it> <qqwf0-2M7-15@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 2015-11-02 22:53:03 +0000, Brian wrote:
> An attacker must inject a payload into a web page that the user visits.
> When the page loads in the user’s browser the attacker’s payload will
> be executed. A user would likely have no knowledge of this, irrespective
> of whatever browser or user-agent string is being used.
> 
> Without the payload (which the bank's site has delivered) the security
> of the browser is not compromised. If a password were to be obtained the
> bank is complicit in the action. I expect they would take responsibilty
> for this.

If the attack is due to a vulnerability in the user's browser and
this browser is blocked by the bank because it is old and no longer
maintained (thus may have known, unfixed vulnerabilities), the user
would be fully responsible. Actually it is the responsibility of
the user to update his software, but bypassing the bank's security
mechanisms makes him even more responsible.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Thread

Iceweasel updates Jack Dangler <tdldev@gmail.com> - 2015-11-02 13:30 +0100
  Re: Iceweasel updates Brad Rogers <brad@fineby.me.uk> - 2015-11-02 13:40 +0100
    Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 13:50 +0100
      Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:10 +0100
        Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:20 +0100
          Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:50 +0100
            Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 15:00 +0100
              Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 16:10 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 23:10 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-03 00:00 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-03 03:00 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-03 15:00 +0100
                Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-04 15:00 +0100
                Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-04 21:00 +0100
                Re: Iceweasel updates Joe <joe@jretrading.com> - 2015-11-03 09:30 +0100
                Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 11:10 +0100
                Re: Iceweasel updates David Wright <deblis@lionunicorn.co.uk> - 2015-11-03 15:30 +0100
  Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:00 +0100
  Re: Iceweasel updates Alex Moonshine <moonshine@openmailbox.org> - 2015-11-02 14:20 +0100
    Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 14:30 +0100
      Re: Iceweasel updates Alex Moonshine <moonshine@openmailbox.org> - 2015-11-02 15:20 +0100
        Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 05:40 +0100
    Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 14:40 +0100
  Re: Iceweasel updates Gene Heskett <gheskett@shentel.net> - 2015-11-02 14:40 +0100
    Re: Iceweasel updates John Hasler <jhasler@newsguy.com> - 2015-11-02 15:10 +0100
      Re: Iceweasel updates Charlie Kravetz <cjk@teamcharliesangels.com> - 2015-11-02 15:30 +0100
        Re: Iceweasel updates Vincent Lefevre <vincent@vinc17.net> - 2015-11-02 15:40 +0100
          Re: Iceweasel updates Lisi Reisz <lisi.reisz@gmail.com> - 2015-11-02 16:20 +0100
        Re: Iceweasel updates Markus Schönhaber <debian-user@list-post.mks-mail.de> - 2015-11-02 15:40 +0100
        Re: Iceweasel updates Jack Dangler <tdldev@gmail.com> - 2015-11-02 17:50 +0100
          Re: Iceweasel updates Brian <ad44@cityscape.co.uk> - 2015-11-02 19:00 +0100
  Re: Iceweasel updates Chris Bannister <cbannister@slingshot.co.nz> - 2015-11-03 05:30 +0100

csiph-web