@Thomas,
Thomas wrote:Why on Earth would a security hole in a browser allow the Chinese government to crack Google's servers?
As far as I understand, that particular part of this "Aurora" attack went something like this:
1) Browser contains a vulnerability that allows for a payload to be installed on the computer.
2) Hackers phish Google employees, tricking them into visiting a malicious link. Visiting this link gets the first malware onto their own computers.
3) This malware uses advanced encryption techniques to avoid detection (e.g. it phones out using HTTPS for one) and pulls down more malware. Now it can install things to log keystrokes, sniff network activity etc.
4) With these tools you can now catch the code repository logins and use the credentials to access the servers.
Quote:And how would your choice of a safer browser protect servers from future attacks? I don't understand the logic of the advice's argument at all.
This kind of thing can and does happen with any browser (e.g. the last examples I recall on a2k of browsers being infected were Firefox), so it's not ultimately going to make a big difference and IMO Germany is one of the leading anti-Microsoft crowds around and this is just another opportunity to say what they already advocated: don't use Microsoft!
Don't use an admin/root account is advice that would have much larger impact.
)