1

I was wondering if I use my computer running Ubuntu only for browsing while using the guest account on an unpatched PC logging in to any site I browse - will it be possible to steal any passwords typed into the browser or not?

Can e.g. a harmful web site steal my administrator password for the PC or even the WiFi password?

3

Spectre and Meltdown are 2 different security issues that both work using a side channel attack that is not remotely exploitable all by itself so if you use your own computer (or someone elses) with only one user logged on, there is no way anyone can read anything even if it's unpatched.¹

On a patched computer running Ubuntu (just run apt dist-upgrade), the Intel Microcode and Linux KPTI will fully protect you even when 2 users would be logged onto the computer and the other user will not be able to read your passwords even if you use them, contrarily to Windows which needs a firmware (BIOS/UEFI/...) update to mitigate against Spectre only as Meltdown has been taken care of by Microsoft and Spectre needs Intel µcode.

¹ Yes, for all the security gurus out there, there is a possibility that another exploit would take control and that one would theoretically be able to read memory on an unpatched computer but let's not confuse the OP as no known exploits exist in the wild at the time of this writing.

  • P.S. So basically all Cloud providers should worry about this, you on your computer on Ubuntu should not worry. Keep your system updated though as today there are no known exploits, but that will change in the future! – Fabby May 15 '18 at 20:56
  • There is rowhammer.js is there not Spectre.js yet? ... there is qubesOS but using a modern kernel (4.14+) is probably enough. – user1133275 May 15 '18 at 23:26
  • 1
    Mitigation of these bugs isn't just "patching", parts of it are only able to be resolved by a redesign of hardware architecture. Guest account doesn't protect as Fabby has indicated. – Thomas Ward May 16 '18 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.