Opera: we will reinvent the Web

I'm not claiming it's new. I'm saying this has the makings of a bad idea, and could do this on whatever platform you install it on - ie. it's not just a windows malware problem.

Couldn't agree more: this indeed has the makings of a very bad idea. Also, clearly it's not just a windows malware problem since Opera is cross-platform.

Also: Passwords sent to this service are done so in plain text. I saw that in the link above, but hadn't found it yet. Tested and confirmed. While I understand why this is so (granting a CA for all those http ssl certs would be insane) it's still bad practice.

Again, agreed. It's not just the granting of the CAs, I guess there are performance issues as well.

ETA:

The file system access is indeed read/write if the widget developer wants it so. See here:

http://www.betanews.com/article/How-secure-is-Opera-Unite/1245176152

Some troubling news... They will never be able to check each and every Unite widget out there. Also, I do not know of a possibility to digitally sign Unite widgets. This ideally would have been mandatory for widgets with read/write access to the file system.

Also troubling is the fact that it seems from the article that Opera did not even attempt to seriously address these issues. Here be dragons...
 
Couldn't agree more: this indeed has the makings of a very bad idea. Also, clearly it's not just a windows malware problem since Opera is cross-platform.



Again, agreed. It's not just the granting of the CAs, I guess there are performance issues as well.



Some troubling news... They will never be able to check each and every Unite widget out there. Also, I do not know of a possibility to digitally sign Unite widgets. This ideally would have been mandatory for widgets with read/write access to the file system.

Also troubling is the fact that it seems from the article that Opera did not even attempt to seriously address these issues. Here be dragons...

100% agreed.

It will take me a few days or a week to fully flush this out and test for security issues. I'll post them here if I find them.
 
Also, for laca:

Apologies for getting snippy/pseudo-flaming. I got the feeling I wasn't making myself clear (which is by no means an unusual event) and was frustrated I couldn't communicate clearer. I'll try not to be as stand-offish. I work hard to not do that. My apologies if you were offended.
 
Also, for laca:

Apologies for getting snippy/pseudo-flaming. I got the feeling I wasn't making myself clear (which is by no means an unusual event) and was frustrated I couldn't communicate clearer. I'll try not to be as stand-offish. I work hard to not do that. My apologies if you were offended.

No worries there... I might be a newcomer at JREF, but I'm by no means new to forums in general. Also, I did not see anything I could have been offended by. And I always enjoy a debate ;)
 

Back
Top Bottom