51–60 of 122 posts
Earlier quoted context omitted.
Twice daily "Adobe updates are available, please download and install!" - annoys me to no end
It frustrates me that EVERY day when I open the Pandora windows desktop app(lication), an Adobe AIR popup asks to install an update. EVERY day! I know Agile is hot and all, but is their AIR framework so fresh that they constantly have to fix things?
I did update it yesterday though!
One bit of advice that should be up there is to run an ad blocker and a flash blocker (not so relevant anymore now that FF started blocking by default). I know, I know, websites depend on ads for revenue. But ads are also a great way to deliver exploits, in addition to all the personal tracking ad networks do. Our number one priority is to protect ourselves, not to protect website revenue.
For the lazy: https://addons.mozilla.org/en-us/firefox/addon/ublock/ https://www.ghostery.com/en/ https://cs.nyu.edu/trackmenot/ https://addons.mozilla.org/en-us/firefox/addon/self-destruct... https://noscript.net/ Anything I missed?
https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...
Some others potentially worth installing:
https://www.eff.org/https-everywhere
https://www.eff.org/privacybadger I prefer this over Ghostery. You can also for the most part replicate Ghostery by just downloading an appropriate filter for Ublock Origin.
https://addons.mozilla.org/en-US/firefox/addon/betterprivacy...
But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices. If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...
Are the security experts are target more likely to attract those who might want to compromise them for bragging rights?
The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
Browsing makes sense, but why email? Unless you run an OS and email client that 1) renders HTML mail by default (making you vulnerable to browser engine attacks) or 2) makes it too easy to run executable email attachments, then is an email client really higher risk than many other pieces of software?
The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
Browsing makes sense, but why email? Unless you run an OS and email client that 1) renders HTML mail by default (making you vulnerable to browser engine attacks) or 2) makes it too easy to run executable email attachments, then is an email client really higher risk than many other pieces of software?
I would never claim to know my email-renderer so well that I was 100% confident that it didn't have any attack vectors, particularly with all the crazy things you can do with unicode nowadays - much more straightforward to just read it in a virtual-machine. That way, even if you guessed wrong on the attack surface of your email client, the damage is contained.
> The high adoption of antivirus software
> among non-experts ... might be due to the
> good usability of the install-once type of
> solution that antivirus software offers.
But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices. If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...
It depends on what your definition of safety is. The perspective of this paper probably relates to compromised accounts and information leaks, not adware infections.
As you point out, there are a variety of attacks and big differences between e.g. leaking a password or getting a virus infection. But since their highlighted techniques cover both of these attacks (virus scanners, password best practices), you have to assume that they are relating to a whole range of attacks.
The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.
Non-developers probably do everything that would be valuable to an attacker in the browser and/or via email. (Heck, what else do people do on a computer?)
[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…
With windows 10 they're doing forced updates for home editions, so there's that.
The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.