From 547b1fda8a9db2dc81baf9b0e79889f3e797d793 Mon Sep 17 00:00:00 2001 From: Fabian Henneke Date: Tue, 30 Apr 2019 22:40:06 +0200 Subject: [PATCH] Clarify security guarantees in case of extension takeover (#145) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1a2e955..2e2ba42 100644 --- a/README.md +++ b/README.md @@ -252,7 +252,7 @@ Browserpass aims to protect your passwords and computer from malicious or fraudu - To protect against phishing, only passwords matching the origin hostname are suggested or selected without an explicit search term. - To minimize attack surface, the website is not allowed to trigger any extension action. Browserpass must be directly invoked by the user. - Only data from the selected password entry is made available to the website. -- Given full control of the non-native component of the extension, an attacker may be able to extract passwords stored in the configured repository, but cannot obtain files elsewhere on the filesystem or execute arbitrary code outside of the browser. +- Given full control of the non-native component of the extension, an attacker may be able to list and decrypt `.gpg` files that can be accessed by the current user, but cannot execute arbitrary code outside of the browser. - Browserpass does not attempt to secure the data it stores in browser local storage, it is assumed that users take precautions to protect their local file system (e.g. by using disk encryption). ## Privacy