A Couple of Thunderbird Questions

Magnus Therning magnus at therning.org
Wed May 4 18:16:53 UTC 2005


On Wed, May 04, 2005 at 01:02:58AM -0700, Daniel Robitaille wrote:
>On Wed, 2005-04-05 at 08:41 +0100, Magnus Therning wrote:
>> Hmmm, I do wonder if that's the reason. I mean '*.default' would find
>> the directory in question. The evil attacker could also simply ready
>> ~/.mozilla/firefox/profiles.ini to find out where the configuration is
>> located. 
>
>I cannot judge if it actually works to have a random path, but a
>security argument is the reason that is usually given for the use of a
>randomly-generated profile path for your mozilla profile.   See for
>example:
>http://ilias.ca/mozilla/profilefaq/#SLT
>
>"3. What's the SLT directory, and why is it there?
>Within your profile folder, there is a folder with 8 random characters
>followed by the extension "slt", which contains all of your profile
>data. This is referred to as a salted directory. When you first create
>your profile, the salted directory is created with a randomly generated
>name. Mozilla does this as a security measure to prevent outsiders from
>being able to predict the file paths of your profile information."

Ah. I should have done some more thinking before posting. The word
'predict' triggered me to do some thinking this time around :-)

I should have added to my previous post that it does raise the bar
somewhat by preventing the attacker from guessing the location. He will
have to do some globbing or read and parse the profile.ini file. Both
would require more work on his part, and probably there are certain
requirements on a vulnerability to make either of the two possible.

/M

-- 
Magnus Therning                    (OpenPGP: 0xAB4DFBA4)
magnus at therning.org
http://magnus.therning.org/

Software is not manufactured, it is something you write and publish.
Keep Europe free from software patents, we do not want censorship
by patent law on written works.

Certum est, quia impossibile. (It is certain, because it is impossible.)
     -- Tertullianus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20050504/a1a8a145/attachment.sig>


More information about the ubuntu-users mailing list