Public Notice - How to hack SAFE Browser Plugin users

[Powersign]

@Seneca

Good thread. I warned for this as well in the discussion about the web proxy idea to support all major browsers

In that thread you mentioned this:

@Seneca

Why not just bundle a rebranded Firefox (including required plugins) with the installer?

I think that would turn newcomers away. It’s very intimidating watching the installer download and put files all over your computer. Then for them to understand why they have to use that browser, and to learn to cope without their favorite X plugin, or Y capability. That is a huge potential barrier to entry.

@dyates

Good to know I’m not the only one concerned with that.

I hadn’t seen your post that you linked, and you 100% foresaw this situation. I’d actually like to take a moment and say that I’ve now seen several forum members in old posts like yours mentioned these security holes, and they seemed to be discussed but never a solution implemented. Maybe we need better communication tools than this forum alone, to better work together for solutions.

@nice

What happens when our user types :

http://really.compromizing-stuff.safeney <– notice the typo ?

in their URL field, and is returned either “Firefox can’t find this page” , or even better a nice list of google results of really compromizing pages ?

First time I’ve seen this mentioned! That’s definitely happened to me and I know it’s happened to others as well. When you manually type in a url, but mispell it, and then your browser doesn’t know what you want so it sends the request to google who logs your request/IP and shows you a list of thing you might be looking for.

@hillbicks

Maybe it would better to set up instructions for using foxyproxy and instructions on how to set up the specific proxy. To prevent usage of the clearnet, people would’ve to switch proxies everytime they want surf the “other” web.

Several other people have asked about using foxyproxy as well, I might just take your advice and do a post about browsing safe using a custom firefox profile.

@Seneca

Rather than compromising the experience of all in an attempt to take care of the hopeless, I’d rather see us first taking care of the security of the not-so-hopeless. Like people who care enough about their privacy to make the effort to distinguish two different buttons.

You already can help yourself though. Use a secure OS from a public hotspot, and run Tor through an anonymous VPN you bought with bitcoin.

I think if the goal is to help the “technically gifted”, then you resolve nothing. Telling your mother to live boot Tails, you’ve already lost her.

It doesn’t cheapen the network to provide a basic level of functionality for an increased level of privacy. Even if a SAFE browser was distributed with WebRTC still enabled, it’s a major step forward.

I’ve talked to several forum members who are having trouble understanding why SAFE isn’t fully protecting them yet. It’s a slow road of education, but to say “I’d rather see us first taking care of the security of the not-so-hopeless” doesn’t seem to align with the community values. In fact is sounds like a 1% vs 99% situation.