How else would you call the possibility to sidestep access controls by setting a specific string as identifier?
> I wasn't able to see any working example, nor any responsible disclosure which seems bad.
First, those two statements kind of contradict each other. Second, from the advisory linked from the article:
10/13/2016 - Vulnerability disclosed to vendor
10/26/2016 - Patch released by vendor
12/12/2016 - Advisory published
> Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point.
Yes, it has been game over all the time: People execute arbitrary code on their machines by installing free programs they downloaded from somewhere. But that's not the point. The point is that some application that has control over very sensitive data includes a possibility (to avoid the word "backdoor") to access that data without user-confirmation and alarms, which are otherwise built into the application on a design level.
How else would you call the possibility to sidestep access controls by setting a specific string as identifier?
> I wasn't able to see any working example, nor any responsible disclosure which seems bad. First, those two statements kind of contradict each other. Second, from the advisory linked from the article:
> Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point.Yes, it has been game over all the time: People execute arbitrary code on their machines by installing free programs they downloaded from somewhere. But that's not the point. The point is that some application that has control over very sensitive data includes a possibility (to avoid the word "backdoor") to access that data without user-confirmation and alarms, which are otherwise built into the application on a design level.