Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comparing how security experts and non-experts stay safe online

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

31–40 of 122 posts

Re: Comparing how security experts and non-experts stay safe online

#31

Post by elorant »

ihsw wrote: post #8
tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

What do most users do with a browser other than open the thing, browse websites, and download files for later?

The download part is the scary one. An average user can’t make the distinction between an OS message and a malware disguising as the former. Thus they download shit that wrecks havoc on their PCs. Besides, you could be infected by a compromised Flash banner so you don't even have to download anything.

And I don’t think that containers are a feasible approach for the average user. I doubt VMs are either. Our best bet would be browsers running in an isolation context simulating a VM. But that would require more RAM than the average user has available.

Re: Comparing how security experts and non-experts stay safe online

#32

Post by JoshTriplett »

tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

Browsing makes sense, but why email? Unless you run an OS and email client that 1) renders HTML mail by default (making you vulnerable to browser engine attacks) or 2) makes it too easy to run executable email attachments, then is an email client really higher risk than many other pieces of software?

Re: Comparing how security experts and non-experts stay safe online

#33

Post by Fritsdehacker »

ihsw wrote: post #8
tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

It would actually be less secure to run your browser in a Docker container. If an attacker can break out of the container, it has root access to your system.

https://zeltser.com/security-risks-and-benefits-of-docker-ap...

Re: Comparing how security experts and non-experts stay safe online

#34

Post by emergentcypher »

One bit of advice that should be up there is to run an ad blocker and a flash blocker (not so relevant anymore now that FF started blocking by default). I know, I know, websites depend on ads for revenue. But ads are also a great way to deliver exploits, in addition to all the personal tracking ad networks do. Our number one priority is to protect ourselves, not to protect website revenue.

Re: Comparing how security experts and non-experts stay safe online

#35

Post by emergentcypher »

ihsw wrote: post #8
tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

> Chrome in a Docker container?

Please dear god no. Kill me now.

Re: Comparing how security experts and non-experts stay safe online

#37

Post by S4M »

tptacek wrote: post #9
ihsw wrote: post #8

Earlier quoted context omitted.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

No. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience. (I hate VMs so much I just use two computers).

How about using two browsers? one of emails or banking and another one for regular browsing?

Re: Comparing how security experts and non-experts stay safe online

#38

Post by transpute »

pothibo wrote: post #27
tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

I'm wondering if this idea will make it to the browser vendor so that their whole runtime is by default in a VM.

Bromium loads each HTTP request in a separate "micro VM". A subset of their technology will be in Win 10: http://learn.bromium.com/microsoft-partnership.html

Re: Comparing how security experts and non-experts stay safe online

#39

Post by theseatoms »

joosters wrote: post #26

But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices. If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...

If they aren't safer online, that'd be a sign to me that I shouldn't bother trying to do everything right.

I don't want invest the time and energy developing expertise when even those that have it don't use it.

Re: Comparing how security experts and non-experts stay safe online

#40

Post by georgerobinson »

zorked wrote: post #25
ihsw wrote: post #8

Earlier quoted context omitted.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

Isn't the Chrome sandbox a better assurance than Chrome-under-Docker? Except for the obscurity angle of course (nobody writes exploits against Chrome-under-Docker). To be fair, VMs are also mostly about the obscurity angle too, and if you do all your browing in a VM the cookies alone will make the attacker sufficiently happy that they will probably not care. People don't hack because they want root on the bare-metal…

> Isn't the Chrome sandbox a better assurance than Chrome-under-Docker?

Sorry, are you referring to Native Client or Chrome's site isolation?

Post reply on HN