Comparing how security experts and non-experts stay safe online • Hacker News Board

Re: Comparing how security experts and non-experts stay safe online

#61

Post by wlesieutre » Thu, Jul 23, 2015, 4:36 PM UTC

wlesieutre wrote: post #51

stephengillie wrote: post #28

Earlier quoted context omitted.

It frustrates me that EVERY day when I open the Pandora windows desktop app(lication), an Adobe AIR popup asks to install an update. EVERY day! I know Agile is hot and all, but is their AIR framework so fresh that they constantly have to fix things?

This is an exaggeration. I did not have to update Adobe AIR today. I did update it yesterday though!

And hey, at least they didn't make an "Adobe AIR Update Manager" that wants to run in the background 24/7. I'm honestly surprised.

Re: Comparing how security experts and non-experts stay safe online

#62

Post by djent » Thu, Jul 23, 2015, 4:36 PM UTC

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

Companies have an interest in forcing users to manually download updates because of ad revenue from the download page, and bundled software on the updater. It will take a lot to convince them to prioritize user security over money.

Re: Comparing how security experts and non-experts stay safe online

#63

Post by Canada » Thu, Jul 23, 2015, 4:38 PM UTC

Something obvious seems missing:

Our systems can be hacked, expert or not. Minimize online footprint. Do not keep years and years of email and other stuff on Internet connected devices, back it up to external media.

Re: Comparing how security experts and non-experts stay safe online

#64

Post by atsaloli » Thu, Jul 23, 2015, 4:44 PM UTC

tptacek wrote: post #9

ihsw wrote: post #8

Earlier quoted context omitted.

Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/fo…

No. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience. (I hate VMs so much I just use two computers).

Illumos zones are as lightweight as containers, can run Linux, and provide full isolation of the guest system. www.illumos.org

Re: Comparing how security experts and non-experts stay safe online

#65

Post by fluidcruft » Thu, Jul 23, 2015, 4:48 PM UTC

wlesieutre wrote: post #50

taeric wrote: post #17

I am personally concerned with the "patch, patch, patch" message. Stated that way, I completely agree with it. However, for many it is just "update, update, update." I'm all for getting the latest security patches. Or any security patches, really. I'm growing tired of getting the latest possibly risky feature from a product because it is the only way I can get a security patch.

Just yesterday, Windows Update automatically installed a driver for my GTX 970. It broke OpenGL and I had to go to Nvidia's website to get their standard driver and reinstall it. And since Windows 10 breaks the ability to block specific updates, I'll probably have to keep the installer around and reinstall it every damn time that Windows Update decides that the driver MS is distributing is better than the one from nv…

I am extremely, extremely skeptical that Microsoft doesn't have a way for nvidia to fix this.

As a heavy desktop Linux user, hearing about examples of half-assed, incompetent, hacky, lazy product support by nvidia isn't exactly new territory.

Nvidia is causing your pain, not Microsoft.

Re: Comparing how security experts and non-experts stay safe online

#66

Post by rilita » Thu, Jul 23, 2015, 4:50 PM UTC

What kind of security experts are they talking to... My personal list of most important things to do:

1. Run a version of Linux ( Windows is simply insecure )

2. Use Firefox + NoScript and only ever temporarilly allow JS to run as needed. ( JS is -not- safe and at any point in time there are at least a handful of zero day exploits )

3. Use an offline password manager ( KeePass )

4. Use a secure anonymous non-logging VPN for all internet use

5. Use a paid private email account, not some free one

6. Use VMs for running software that may not be safe

Re: Comparing how security experts and non-experts stay safe online

#67

Post by MichaelGG » Thu, Jul 23, 2015, 4:52 PM UTC

thematt wrote: post #15

tptacek wrote: post #9

Earlier quoted context omitted.

No. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience. (I hate VMs so much I just use two computers).

Why do you hate VM's so much? Usability? Or is there some technical reason?

Because VMware has essentially abandoned their client virtualization software? (Workstation 11 is a paid minor bug fix.) While it's way better than VirtualBox, it's still annoying. Stuff like USB devices will randomly not work. You need more system resources, which heats up the machine, making it hot to the touch. Oh and it crashes at times, too. With Windows-on-Windows setup, I was having daily crashes. VMware doesn't seem to care and offers no support with the product (gotta buy a company support plan). They even had a kb article to the effect of "Known issue: Workstation crashes when you run Office 2007".

It's usable, just a bit annoying. I feel little option but to run Windows as a host OS in order to get best driver/video/battery support, so VMware is essentially mandatory.

It's also a huge attack surface.

Re: Comparing how security experts and non-experts stay safe online

#68

Post by sgc » Thu, Jul 23, 2015, 5:02 PM UTC

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

As long as you aren't constantly bricking/breaking things, as has happened to me with updates from Windows 8 and Office.

Re: Comparing how security experts and non-experts stay safe online

#69

Post by wlesieutre » Thu, Jul 23, 2015, 5:04 PM UTC

fluidcruft wrote: post #65

wlesieutre wrote: post #50

Earlier quoted context omitted.

Just yesterday, Windows Update automatically installed a driver for my GTX 970. It broke OpenGL and I had to go to Nvidia's website to get their standard driver and reinstall it. And since Windows 10 breaks the ability to block specific updates, I'll probably have to keep the installer around and reinstall it every damn time that Windows Update decides that the driver MS is distributing is better than the one from nv…

I am extremely, extremely skeptical that Microsoft doesn't have a way for nvidia to fix this. As a heavy desktop Linux user, hearing about examples of half-assed, incompetent, hacky, lazy product support by nvidia isn't exactly new territory. Nvidia is causing your pain, not Microsoft.

I'm not sure sure you can blame it all Nvidia. The versions that Microsoft ships are written by Nvidia, yes, but they're torn down to essentials with a bunch of features removed. Among those, Nvidia's various control panel type addons, and apparently some important OpenGL extensions that LWGL relies on.

By going through WHQL, Nvidia gets to have better out of the box support on Windows, and Microsoft gets to ship a stripped down driver without Nvidia's control panel cruft and with better support for DirectX than OpenGL.

I don't see what Nvidia's motivation for the last part is unless Microsoft said "Don't bother including all of the OpenGL capabilities, DirectX is fine for basic drivers."

Re: Comparing how security experts and non-experts stay safe online

#70

Post by eldridgea » Thu, Jul 23, 2015, 5:09 PM UTC

rilita wrote: post #66

What kind of security experts are they talking to... My personal list of most important things to do: 1. Run a version of Linux ( Windows is simply insecure ) 2. Use Firefox + NoScript and only ever temporarilly allow JS to run as needed. ( JS is -not- safe and at any point in time there are at least a handful of zero day exploits ) 3. Use an offline password manager ( KeePass ) 4. Use a secure anonymous non-logging…

Those sounds good but I'm shying away from Firefox at the moment for security. I love their open source approach and would prefer my browser to be open source.

However Firefox does not have tab sandboxing, extension sandboxing, or process isolation. These are pretty standard features in most browsers now (except for process isolation which seems to be Chrome only at present).