Interesting article about the security concerns: http://www.betanews.com/article/How-secure-is-Opera-Unite/1245176152
Interesting article about the security concerns: http://www.betanews.com/article/How-secure-is-Opera-Unite/1245176152
I'm not claiming it's new. I'm saying this has the makings of a bad idea, and could do this on whatever platform you install it on - ie. it's not just a windows malware problem.
Also: Passwords sent to this service are done so in plain text. I saw that in the link above, but hadn't found it yet. Tested and confirmed. While I understand why this is so (granting a CA for all those http ssl certs would be insane) it's still bad practice.
ETA:
The file system access is indeed read/write if the widget developer wants it so. See here:
http://www.betanews.com/article/How-secure-is-Opera-Unite/1245176152
Couldn't agree more: this indeed has the makings of a very bad idea. Also, clearly it's not just a windows malware problem since Opera is cross-platform.
Again, agreed. It's not just the granting of the CAs, I guess there are performance issues as well.
Some troubling news... They will never be able to check each and every Unite widget out there. Also, I do not know of a possibility to digitally sign Unite widgets. This ideally would have been mandatory for widgets with read/write access to the file system.
Also troubling is the fact that it seems from the article that Opera did not even attempt to seriously address these issues. Here be dragons...
Also, for laca:
Apologies for getting snippy/pseudo-flaming. I got the feeling I wasn't making myself clear (which is by no means an unusual event) and was frustrated I couldn't communicate clearer. I'll try not to be as stand-offish. I work hard to not do that. My apologies if you were offended.