Hacker News Reader

> I also always log in as root. I like to live dangerously. :)

Man... I cannot even begin to express how bad this is.

Especially if there are drive-by attacks.

Running as a privileged user protects other users and the OS, not you. If code runs as you, it has access to your data, your cookies, your cache, etc.

Protecting the OS does protect you: stealing my data/cookies today is different than installing OS level backdoor / keylogger and stealing my bank password, tax prep, etc next month/year/etc.

So, installing a backdoor / keylogger in user level isn't that bad? why?

If they've stolen your cookies, they can already login as you. The keylogger is already going to run in user space, as you.

You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.

Reply on news.ycombinator.com