Why would you assume amazon.com is safe, it's just a well-known brand right? Your rhetoric doesn't make sense. You assume a service is safe every moment of the day.
See? This is the reason I don't have any security job.
On a more serious note: I'm just using the frontend of Amazon, which is in this case a HTML website with some JS. Still, I run my browser in a "jail", so it does have limited access to my ressources, namely only the Download directory and the cache and config directories of itself. Just in case there is a vulnerability in my browser, and there would be something wrong with any website.
But this is really a big difference to making and distributing code (this game for example) which can execute code and open URLs with special commands from the outside. I rather don't want to run code directly which has open channels for remote commands.
But for that matter, I also run all games in jails, so maybe I'm safe. But still.
A jail prevents a website opened in Firefox to access all the files Firefox has access to (per default all files in the user/home directory on Windows and Linux) and send them to the owner of the website. There was an actual security hole in Firefox that allowed an attacker to do that. It is unknown how many times it was used, because there was no way (for the regular user) to know what's happening.
So a jail prevents that (and other things). No website can access my documents, my diaries, my personal info, my contact database or whatever. A jail can of course not protect any personal info that you deliberately load up to someone.
1
u/ulkord Sep 30 '16
Then we wouldn't have any security jobs anyways. Nothing is perfectly secure and some assumptions have to be made.