Comparing how security experts and non-experts stay safe online
googleonlinesecurity.blogspot.com
Comparing how security experts and non-experts stay safe online
1–10 of 122 posts
Re: Comparing how security experts and non-experts stay safe online
#2Brilliant. Measuring how well typical users understand/implement security measures has long been overdue.
Personally, I find Figure 2 (on Page 5) of the paper most interesting: it shows the difference between expert and non-expert mentioning certain practices -- which to me seems roughly equal to how under-/overappreciated that practice is.
The top contenders for underrated (i.e. used more frequently by experts compared to non-experts) are: System updates, 2-factor-auth, password managers, unique passwords and checking for https. Most overrated: antivirus, password changes, only visiting known sites and using strong passwords.
As a security community, we appear to have gotten the point across when it comes to antivirus and strong passwords. Anyone giving general advice should consider this and emphasize the "underrated" measures.
Re: Comparing how security experts and non-experts stay safe online
#3Brilliant. Measuring how well typical users understand/implement security measures has long been overdue. Personally, I find Figure 2 (on Page 5) of the paper most interesting: it shows the difference between expert and non-expert mentioning certain practices -- which to me seems roughly equal to how under-/overappreciated that practice is. The top contenders for underrated (i.e. used more frequently by experts compa…
> Anyone giving general advice should consider this and emphasize the "underrated" measures.
Funny enough, we did exactly that last month!
https://paragonie.com/blog/2015/06/guide-securing-your-busin...
Unfortunately, Archive.org did not crawl us before this Google blog post came out, so I can't prove that I did not ninja edit the post. Google has a cache from July 8, though: https://webcache.googleusercontent.com/search?q=cache:-ovweQ...
Re: Comparing how security experts and non-experts stay safe online
#4The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
Re: Comparing how security experts and non-experts stay safe online
#5The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
This is true. I'm hoping the "browse in a VM" thing catches on with the public, even if it's for the "I want to hide my browser history from my significant other" sort of reasons.
Re: Comparing how security experts and non-experts stay safe online
#6The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
I'm a bit surprised that using a virtual machine was mentioned nowhere in the paper.
Edit: I'm also surprised that we have such a large proportion of this discussion talking about something (using VMs) that is mentioned nowhere in the paper the thread is supposedly about. Perhaps if we were also discussing the (apparently) surprising fact that it was not mentioned it would make sense (to me, anyway).
Re: Comparing how security experts and non-experts stay safe online
#7Do security experts place less emphasis on virus scans because they do their browsing on OS for which virus scanning is less important?
EDIT This question is partly motivated by wondering if a Linux browsing user should be running a virus scanner?
Re: Comparing how security experts and non-experts stay safe online
#8The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
Can we settle for containers instead?
For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility?
I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/folders and dragging them out of the browsers "Download" folder and onto the host's file system, disallowing saving files outside of that folder, and so forth) but it doesn't seem that bad.
What do most users do with a browser other than open the thing, browse websites, and download files for later?
Re: Comparing how security experts and non-experts stay safe online
#9The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…
No. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience.
(I hate VMs so much I just use two computers).
Re: Comparing how security experts and non-experts stay safe online
#10Do security experts place less emphasis on virus scans because they do their browsing on OS for which virus scanning is less important? EDIT This question is partly motivated by wondering if a Linux browsing user should be running a virus scanner?
Not really. It's more of:
- many would prefer to whitelist trusted software than blacklist malware
- bypassing AV is trivial
- http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf
- https://github.com/Veil-Framework/Veil-Evasion
Great question, though. :)