Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#231

Post by Godel_unicode »

wintermutestwin wrote: post #174
ttctciyf wrote: post #56

Earlier quoted context omitted.

> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additiona…

>Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. What I am looking for is an easy way to run something like a LiveCD OS in a VM for browsing. The problem is that I have never found a decent LiveCD that has Firefox with all of the mandatory extensions (uBlock Origin, etc...). I guess I could customize my own Liv…

Windows AppGuard is close to this, although it’s a hyper-v silo not a full VM. Edge can open links in AppGuard (which is what this technology is called) right from the context menu, super convenient.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-...

Re: Ask HN: How do you trust that your personal machine is not compromised?

#233

Post by voytec »

I use a OS from a vendor not obsessed with usage monetization nor any kind of "phone home" functionality.

I consider internet browsers to be a be a major backdoor risk and thus have none installed on my host OS. I only browse interwebs from VMs.

I don't trust my home network the same as I wouldn't trust an open public WiFi.

I don't assume everything is as secure as it could be and am taking redundant steps to ensure certain stuff.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#234

Post by phyphy »

lrem wrote: post #148
gkbrk wrote: post #137

Earlier quoted context omitted.

If the apps sandboxed, how can installing an app cause breaches? As far as I know, iOS apps are sandboxed. Either the sandbox is very weak and Apple instead relies on App Store audits, or they disallow users installing apps outside the app store to protect their 30% tax that makes them a LOT of money.

When you’re tricked into installing a nasty app, you’re likely also tricked into giving it whatever permissions it needs for the nastiness.

Which is not the fault of the OS

Re: Ask HN: How do you trust that your personal machine is not compromised?

#235

Post by lamontcg »

If you're just a rando who isn't likely to get specific attention from someone like the NSA or other state-backed threat agents, then the answer is that if everything is behaving normally that you're not compromised. For the bulk of people if someone breaks into your personal device they're going to start using it for something. You'll see unusual utilization, your proxy settings on your browser will get changed, you'll just be hit by a ransomware attack and your drive will be encrypted and you'll be locked out, etc. They're after the bulk of the users out there and they don't need to be particularly stealthy about anything.

Of course if you have large quantities of BTC or something then the answer is to get it off of your personal machine and setup a cold wallet that cannot be hacked, and stop installing clever looking crypto shit on your machine.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#236

Post by modeless »

For some excellent advice on security and privacy based on thoroughly researched technical concerns rather than speculation or blind trust in any particular organization (e.g. Apple or Google or Mozilla), see here: https://madaidans-insecurities.github.io/ I found the Android and Firefox/Chromium evaluations particularly interesting.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#237

Post by cm_silva »

rvillanueva wrote: post #36

Like others here are saying, you can never be 100% sure. But that doesn’t mean there’s nothing you can do. If you’re worried about the impact to your broader organization (which is what most of the sophisticated threats tend to target), you should think about risk mitigation through the Swiss Cheese defense model. Each system is inevitably going to have holes, but layering them on top of one another will incrementall…

Exactly this. Security is more about about defense-in-depth, incident response and recovery planning.

Personally, I assume the hardware is already compromised and plan for recovery accordingly, starting with the worse case scenario. Then, I ask myself "If this thing isn't compromised yet, how can I help it stay so?", starting probably with the network access, through firmware, all the way to the browser.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#238

Post by SnowHill9902 »

You generally don’t. It all depends on your attack hypothesis. Are you a Mossad target or a non-Mossad target? The best you can do if you are a non-Mossad target is to anonymously/pseudonymously periodically purchase new hardware and do a fresh OS install. Be minimalistic. If you can’t trust your wifi-enabled printer, disable its wifi connectivity and use it only over USB. If you still can’t trust it, don’t use printers to begin with.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#239

Post by fragmede »

lrem wrote: post #148
gkbrk wrote: post #137

Earlier quoted context omitted.

If the apps sandboxed, how can installing an app cause breaches? As far as I know, iOS apps are sandboxed. Either the sandbox is very weak and Apple instead relies on App Store audits, or they disallow users installing apps outside the app store to protect their 30% tax that makes them a LOT of money.

When you’re tricked into installing a nasty app, you’re likely also tricked into giving it whatever permissions it needs for the nastiness.

the malicious app, even signed off the app store could also exploit unpublished vulnerabilities to gain elevated access and not require asking for permission. even or especially if it's not a full sandbox escape.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#240

Post by pjmlp »

flanked-evergl wrote: post #192
lrvick wrote: post #159

Earlier quoted context omitted.

IMO we have to step back and be honest that the Linux kernel is simply not equipped to run trusted code and untrusted code in the same memory. New bugs are found every few weeks. If history is of any guide Android and ChromiumOS likely still have many critical bugs the public does not know about yet. Sadly the only choice is to burn extra ram to give every security context a dedicated kernel and virtual machine. Hype…

> Linux kernel is simply not equipped to run trusted code and untrusted code in the same memory. Just for interest sake, is Linux better or worse than MacOS, iOS and Windows at this?

Windows 10 and later run drivers and parts of the kernel on their own hypervisor slots.

macOS has SIP.

GNU/Linux is still not there doing this out of the box.

Post reply on HN