graham.coles@the-logic-group.com wrote:
>> It works for:
>> the same user using ssh as is on the console;
> If someone can remotely log in as you over ssh then they already have your
> password (or worse, certificate!), so why would they try to obtain it from
> a browser?
They can obtain other stuff that I type in the browser, such as
passwords etc that I might use for online banking and which I don't
store in Keychain. Personally, I don't think that the Keychain bit is
particularly important.
> They already have total access to all your files, there would appear to be
> nothing more to gain from this.
Perhaps you do (in which case I recommend you stop), but I don't store
all my information in files, and of that which I do, not all those files
are merely protected by my standard login and password. Some, such as
how I authenticate to my bank, are stored in a gpg-encrypted file in
case I ever forget. Others, such as my gpg passphrase, live only in my
head. Trust me, merely logging in as me won't help anyone get at those
data.
>> the root user using ssh (or someone who can sudo) can inject
>> Javascript into the console user's browser;
> Are you even considering what you are saying?
Yes. Are you?
> Someone has *ROOT* access to your system REMOTELY over ssh and you're
> worried that they might be able to retrieve a password from your keychain.
Yes, it would be annoying if someone rooted my laptop. It would be a
lot more annoying if they not only rooted my laptop but also cleaned out
my bank account via my browser.
It *is* somewhat disturbing that root can so trivially interfere with
the guts of someone else's processes. Normally, root has to do a lot of
work to do that.
>> a different non-root user on the console can do it too
> Which again restricts this vunerability (as previously mentioned) to an
> attacker who happens to be sitting in front of your machine(!)
Did you read the bit where I speculated about setuid applications?
--
David Cantrell