Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comparing how security experts and non-experts stay safe online

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

21–30 of 122 posts

Re: Comparing how security experts and non-experts stay safe online

#21

Post by recursive »

JupiterMoon wrote: post #16
ihsw wrote: post #8

Earlier quoted context omitted.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

It's very easy (trivial even?) to browse in e.g. Virtual Box these days - why do the less secure thing?

Anything that takes more than a dozen steps is not trivial.

Re: Comparing how security experts and non-experts stay safe online

#22

Post by gmac »

JupiterMoon wrote: post #7

Do security experts place less emphasis on virus scans because they do their browsing on OS for which virus scanning is less important? EDIT This question is partly motivated by wondering if a Linux browsing user should be running a virus scanner?

I'm not a security expert, but I don't use any 'continuous scan' anti-virus on my Mac because I strongly suspect it would make the system more vulnerable, not less.

See, for example, https://lock.cmpxchg8b.com/sophailv2.pdf

Re: Comparing how security experts and non-experts stay safe online

#23

Post by [deleted] »

ihsw wrote: post #8
tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

[deleted]

Re: Comparing how security experts and non-experts stay safe online

#24

Post by tptacek »

thematt wrote: post #15
tptacek wrote: post #9

Earlier quoted context omitted.

No. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience. (I hate VMs so much I just use two computers).

Why do you hate VM's so much? Usability? Or is there some technical reason?

Just slowness and usability. Also: as a defense, it's imperfect.

Re: Comparing how security experts and non-experts stay safe online

#25

Post by zorked »

ihsw wrote: post #8
tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

Isn't the Chrome sandbox a better assurance than Chrome-under-Docker?

Except for the obscurity angle of course (nobody writes exploits against Chrome-under-Docker).

To be fair, VMs are also mostly about the obscurity angle too, and if you do all your browing in a VM the cookies alone will make the attacker sufficiently happy that they will probably not care. People don't hack because they want root on the bare-metal OS, people hack because they want to steal data. If it's in a VM or container, then getting there is enough.

Re: Comparing how security experts and non-experts stay safe online

#26

Post by joosters »

But are the security experts actually safer online?

The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices.

If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...

Re: Comparing how security experts and non-experts stay safe online

#27

Post by pothibo »

tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

I'm wondering if this idea will make it to the browser vendor so that their whole runtime is by default in a VM.

Re: Comparing how security experts and non-experts stay safe online

#28

Post by stephengillie »

gesman wrote: post #18
taeric wrote: post #17

I am personally concerned with the "patch, patch, patch" message. Stated that way, I completely agree with it. However, for many it is just "update, update, update." I'm all for getting the latest security patches. Or any security patches, really. I'm growing tired of getting the latest possibly risky feature from a product because it is the only way I can get a security patch.

Twice daily "Adobe updates are available, please download and install!" - annoys me to no end

It frustrates me that EVERY day when I open the Pandora windows desktop app(lication), an Adobe AIR popup asks to install an update. EVERY day! I know Agile is hot and all, but is their AIR framework so fresh that they constantly have to fix things?

Re: Comparing how security experts and non-experts stay safe online

#30

Post by JupiterMoon »

recursive wrote: post #21
JupiterMoon wrote: post #16

Earlier quoted context omitted.

It's very easy (trivial even?) to browse in e.g. Virtual Box these days - why do the less secure thing?

Anything that takes more than a dozen steps is not trivial.

If your using a Linux distro already you have to: 1. install virtual box from package manager 2. download .iso of some distro 3. install 4. update virtual machine 5. browse

Of these someone who's installed their own OS has 2 slightly novel steps. So yeah trivial is maybe the wrong words but still easy.

Post reply on HN