Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#51

Post by KineticLensman »

amelius wrote: post #20
gnfargbl wrote: post #9

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-... . It is aimed mostly at small businesses, but I find a lot of the guidance to be pretty relevant to my personal IT. My even shorter (and incomplete) summary of the document would be: configure your router and firewall; remove default passwords and crapware from your devices; use a lock s…

Do you lock your computer every time you leave your desk? And do you always check for keylogger thumbdrives and such?

> Do you lock your computer every time you leave your desk?

This was a corporate requirement where I used to work, unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#53

Post by denton-scratch »

I don't trust that my machines are not compromised.

All I can do is to start with a machine I believe to be "clean", and take measures to keep it that way (others have suggested suitable measures). But even a brand-new machine might have a compromised BIOS, or compromised firmware in some peripheral processor like the Wifi adaptor.

I don't know how to guarantee that a machine is "clean" to begin with, and I doubt anyone else does.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#56

Post by ttctciyf »

gnfargbl wrote: post #9

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-... . It is aimed mostly at small businesses, but I find a lot of the guidance to be pretty relevant to my personal IT. My even shorter (and incomplete) summary of the document would be: configure your router and firewall; remove default passwords and crapware from your devices; use a lock s…

> enable anti-malware if your OS has it . . . Would be interested in hearing other things

Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious.

For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features".

An additional step I take is to use several browser profiles for different purposes (mail, banking, shopping, default, to name four) so that Firefox always asks me to pick a profile on startup. As well as reducing the possibility of XSS, this lets me relax the settings for some profiles where I restrict myself to a small number of trusted sites. (This may well be overkill!)

0: uBlock Origin, that is, as per instructive commment below[1]

1: https://news.ycombinator.com/item?id=34389942

Re: Ask HN: How do you trust that your personal machine is not compromised?

#57

Post by wiz21c »

I protect my machine from as many commercial interests as I can. This removes a whole class of issues.

For the rest, the thing is so complicated nowadays I can't really say anymore.

I spent my youth on 8 bit machines. At that time I was 100% certain there was no compromise. But nowadays,...

Re: Ask HN: How do you trust that your personal machine is not compromised?

#58

Post by ulimn »

checkyoursudo wrote: post #33

Bios? I'm not sure I can ever be certain. For the rest, I run a pretty esoteric setup (compiled-from-source custom configured linux kernel with no binary blobs; all software compiled from source, with no exceptions; aggressive, burdonsome-to-me privilege separation; chroots and VMs for various degrees of potential threat; etc). I have no illusions that it is perfectly safe. What I am comfortable with is that, in orde…

I'm genuinely curious: Do you check/audit the code you compile and run on your machine? Going with the assumption of "no": How is it then different than downloading a prebuilt version from an official source?

Re: Ask HN: How do you trust that your personal machine is not compromised?

#59

Post by ghostpepper »

gnfargbl wrote: post #9

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-... . It is aimed mostly at small businesses, but I find a lot of the guidance to be pretty relevant to my personal IT. My even shorter (and incomplete) summary of the document would be: configure your router and firewall; remove default passwords and crapware from your devices; use a lock s…

Since you mention routers, I’m curious what brand you use.

Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#60

Post by krn »

> "Compromised" meaning that malware hasn't been installed or that it's not being accessed by malicious third parties. This could be at the BIOS, firmware, OS, app or any other other level.

I don't believe there is a way to be 100% certain, but if I had to go to a store and pick a new device with the lowest likelihood of being compromised, it would be a desktop, a laptop, or a tablet running ChromeOS[1].

[1] https://www.chromium.org/chromium-os/chromiumos-design-docs/...

Post reply on HN