|
RE: Bugs in the new HUD
The security problem is that the example of the problem is So LAME.
A better example would be a spoofed login page. Using the Second Life viewer (or most, if not all, third party viewers) you (the user) have NO way to determine the web site (URL) which you're seeing. So it is a simple matter for someone to create a web page which, for example, looks exactly like the KittyCats login page but, unbeknownst to you, it's actually a page on another server. It is a simple matter to collect your username and password, record them, and thenpass them along to kittycats.biz so you're properly logged in and using the actual site, as normal. Then, at a later time, the attacker logs in as you and does whatever you're allowed to do on the site.
For most of us, that's not a huge issue. But .. just think where the attacker would be if they could actually get KittyCatS Resident to use .. just once .. the login page on their prim!
To make it worse, there is NO record of any of this happening.
Linden Labs is not involved .. none of their servers have any record of you ever looking at the prim and interacting with that web page.
Your web history has no record since it was done with the browser built into the viewer.
The ONLY records are with your ISP, assuming they record ALL your traffic, and with the attacker's web server, which, of course, the attacker controls.
Remember, though, this is still a lame-ass example. Only the most neophyte script kiddie would be so simplistic. A concerted attacker would be much more aggressive and, with careful work, be able to take over your computer completely. So, the symptom may not be that you're reading postings you never did .. it may be a visit from the FBI seizing your computer to determine why you broke into Sony and stole their financial records.
|
