Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 15 submissions in the queue.
posted by martyb on Sunday November 25 2018, @01:59AM   Printer-friendly
from the welcome-to-the-danger-zone dept.

Google and Mozilla are working together on a method to let web apps gain access to users' files.

A group led by Google and Mozilla is working to make it easy to edit files using browser-based web apps but wants advice on how to guard against the "major" security and privacy risks.

The idea is to allow users to save changes they've made using web apps, without the hassle of having to download new files after each edit, as is necessary today.

[...] the W3C Web Incubator Community Group (WICG), which is chaired by representatives from Chrome developer Google and Firefox developer Mozilla, is working on developing the new Writable Files API, which would allow web apps running in the browser to open a file, edit it, and save the changes back to the same file.

However, the group says the biggest challenge will be guarding against malicious sites seeking to abuse persistent access to files on a user's system.

"By far the hardest part for this API is of course going to be the security model to use," warns the WICG's explainer page for the API.

"The API provides a lot of scary power to websites that could be abused in many terrible ways.

What could possibly go wrong?


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2, Interesting) by tftp on Sunday November 25 2018, @03:27AM (3 children)

    by tftp (806) on Sunday November 25 2018, @03:27AM (#766082) Homepage

    What's left? To run the browser in a good, secure VM (if such a thing exists) - or on a separate computer. Today it is trivial - tablets, R-Pis, old smartphones, TVs ... this will block access to your files reliably, proportional to security of your network (vpn tunneling + blocking direct access at a separate firewall is always a plus.) For home/recreational use this is all that is needed; plus your browsing device is not cluttered with other applications.

    Professional use comes with more expensive precautions. Airgapped LANs are well known in many places. Otherwise establish unidirectional flow of sanitized data from the browsing box into a shared drive that can be read by the more secure computers.

    Starting Score:    1  point
    Moderation   +1  
       Interesting=1, Total=1
    Extra 'Interesting' Modifier   0  

    Total Score:   2  
  • (Score: 2) by bzipitidoo on Sunday November 25 2018, @04:27AM (2 children)

    by bzipitidoo (4388) on Sunday November 25 2018, @04:27AM (#766088) Journal

    In summary, if they don't science the shit out of this user file access idea, users will have to sandbox the shit out of the browsers.

    Probably should've been sandboxing browsers all along anyway.

    • (Score: 3, Insightful) by Anonymous Coward on Sunday November 25 2018, @04:31AM (1 child)

      by Anonymous Coward on Sunday November 25 2018, @04:31AM (#766090)
      With recent exploits no sandboxing is safe.
      • (Score: 0) by Anonymous Coward on Monday November 26 2018, @01:55PM

        by Anonymous Coward on Monday November 26 2018, @01:55PM (#766441)

        Or only buy computers capable of running registered memory.

        And that is ignoring the speculative execution and other timing/race leaks in modern processors.

        Very little hardware can be considered secure from either hackers or state level adversaries largely because of the commercial limitations of available consumer electronics.