I use locked down apple devices and wireguard to a remote server to do work, so all my actually sensitive data resides on the remote server that is reasonably hardened, and I believe I would hear if iPadOS was compromised to an extent that I need to worry about it farily quickly, I hope so at least.
Ask HN: How do you trust that your personal machine is not compromised?
81–90 of 469 posts
Re: Ask HN: How do you trust that your personal machine is not compromised?
#82Earlier quoted context omitted.
> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additiona…
Firefox multi-account containers can be a more convenient way to isolate things, especially now that the container can be limited to only the allowed sites. I also made an app and extensions to help me use multiple browsers, one per site. (Browsr Router)
Regards the containers, I started my profile compartmentalization practice before they arrived, so I never explored them. But I'm curious as to whether each container comes with a complete set of browser permissions, like profiles do, which would enable you (for example) to have a location-enabled container specifically for google maps (in reference to[0]) while disabling it on the container used for search, as you could quite easily do with profile compartmentalization? (Which, tbf, is a privacy rather than a security concern.)
0: https://www.simpleanalytics.com/en/blog/google-changed-googl...
Re: Ask HN: How do you trust that your personal machine is not compromised?
#83You can play with this in that situation. I assume all my cloud and local data is and just keep that in mind. But I also assume there's layers of access... so not everyone who can access it, has access to every part of it. One group maybe can access DNS queries; one group can access cellphone metadata and SMS; one group maybe can access unencrypted iCloud/Google/OneDrive data; one group needs warrants to access and creates lies to fraudulently obtain/fake-justify those; some other group doesn't need warrants and just has access, either through agreement or covert access.
Once Advanced Data Protection switches on globally "in early 2023" I'll have another compartment. But I assume that someone can access basically everything. You can have fun with it.
I also think what's happening on my devices is some of the least interesting parts of life, so, yeah, there's that, too. :)
Re: Ask HN: How do you trust that your personal machine is not compromised?
#84Re: Ask HN: How do you trust that your personal machine is not compromised?
#85Separation of concerns is a good idea. Don't run everything together, e.g. multiple boot Os, or nested OS (windows with several WSL setups for different work, test untrusted windows apps first in windows development VM etc.). If you have a server, run dedicated VMs and work on those via remote, these days you can even stream your games from your dedicated VM. In case a game is compromised, it will at maximum compromi…
A workflow that involves multiple VMs is usually very cumbersome.
I feel that our OSes should solve this problem. Unix was built with the mindset that other users cannot be trusted, but they forgot that applications can also be malicious. There is a huge opportunity here for better OSes.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#86Bios? I'm not sure I can ever be certain. For the rest, I run a pretty esoteric setup (compiled-from-source custom configured linux kernel with no binary blobs; all software compiled from source, with no exceptions; aggressive, burdonsome-to-me privilege separation; chroots and VMs for various degrees of potential threat; etc). I have no illusions that it is perfectly safe. What I am comfortable with is that, in orde…
I'm genuinely curious: Do you check/audit the code you compile and run on your machine? Going with the assumption of "no": How is it then different than downloading a prebuilt version from an official source?
It feels like a cargo cult approach to the problem. "I'm safe because I compile from source" is an absurd statement when a million LoC is involved.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#87Earlier quoted context omitted.
Do you lock your computer every time you leave your desk? And do you always check for keylogger thumbdrives and such?
Lock my computer: Always[1][2]. Check for keylogger thumbdrives: I use a laptop so it would be immediately obvious. But now that you say it I haven't checked the charger USB-outlet on the back of my cabled keyboard. [1]: it has happened I have failed. Once a year or something. [2]: I sometimes try to allow myself to go downstairs in my own house to fetch a cup coffe without locking when I am alone, but I find it so s…
I've worked in places where that once a year slip-up would mean you sent an email offering to buy lunch for the team or get your background changed to a David Hasselhoff pinup picture from the 80's. I do feel weird locking my computer when I'm alone though.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#88Earlier quoted context omitted.
Do you lock your computer every time you leave your desk? And do you always check for keylogger thumbdrives and such?
> Do you lock your computer every time you leave your desk? This was a corporate requirement where I used to work, unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.
> unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.
Same here. The all time favorite is sending a resignation notice to the person's manager (the manager usually gets a fair warning first and plays along with it).
Re: Ask HN: How do you trust that your personal machine is not compromised?
#89The same way you can't be sure that when you drive to work today you are not going to die, you can't be sure that your machine isn't compromised somewhere. That's just how reality is: safety is an illusion.
Like with driving, make an effort to lower the probability to wherever makes you comfortable, then just accept that there's a non-zero chance it wasn't good enough.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#90On my and my families windows machines, I try to follow the advice from Taylor Swift who seems to know what she is doing... https://decentsecurity.com/#/securing-your-computer/ In short: 1) secure bootup by locking up BIOS and encrypting your drive 2) set User Access Controls to the highest level 3) install up to date browser with appropriate addons (ublock)
I would wait with getting the latest Windows updates, If I don't see anything in the news after a month, that's when I update.
Would very much recommend updating Windows ASAP.