> Whilst Crowdstrike are going to cop a potentially existential-threatening amount of blame, an application shouldn't be able to do this kind of damage to an operating system.
It doesn't operate in user space, they install a kernel driver.
There are other paths to the attack he mentioned. Eg you find an API that accepts ciphertext or part of. Or a cloud backup/restore flow. Likely you need another vulnerability but it does happen.
Useful because you can support existing passwords without requiring everyone to login or reset their password. Still has flaws though, like password shucking.
Doesn't that argument apply to tabs also? Eg IE6 days where there were no tabs, and everything was deferred to the OS/desktop window management. It was clunky and painful.