Comparing how security experts and non-experts stay safe online • Hacker News Board

Re: Comparing how security experts and non-experts stay safe online

#101

Post by Eiriksmal » Thu, Jul 23, 2015, 9:25 PM UTC

JupiterMoon wrote: post #30

recursive wrote: post #21

Earlier quoted context omitted.

Anything that takes more than a dozen steps is not trivial.

If your using a Linux distro already you have to: 1. install virtual box from package manager 2. download .iso of some distro 3. install 4. update virtual machine 5. browse Of these someone who's installed their own OS has 2 slightly novel steps. So yeah trivial is maybe the wrong words but still easy.

You forgot step 1.5: spend forever signing the VM kernel modules so they can be started under secure boot. Such pain. Fortunately, once the signature's in the UEFI, upgrading from Fedora 20 to 22 just necessitates resigning the new VirtualBox module without the UEFI steps.

http://gorka.eguileor.com/vbox-vmware-in-secureboot-linux/

Re: Comparing how security experts and non-experts stay safe online

#102

Post by GrinningFool » Thu, Jul 23, 2015, 9:26 PM UTC

tene wrote: post #99

modeless wrote: post #92

Earlier quoted context omitted.

Great, so reduce the time estimate by an order of magnitude. Now you're only wasting 19 human lifetimes per update. Hooray?

I have some bad news for you; companies imposing costs on others to reduce their own cost is extremely common: https://en.wikipedia.org/wiki/Externality

s/companies/people

Re: Comparing how security experts and non-experts stay safe online

#103

Post by ploxiln » Thu, Jul 23, 2015, 9:27 PM UTC

Florin_Andrei wrote: post #90

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

Exposing the whole update process to the end user is like exposing the innards of the car's engine to the driver. There's no need to do that. They don't need to be aware of it. It should be just part of the daily magic to them, the stuff that keeps things running even though they don't understand how it happens or are not even aware of it. Of course, the intricacies of the process should still be exposed to the techn…

... but you can't avoid exposing the fact that the application substantially changed with no advance notice or control, because today's updates are not just security / bug fixes but also UI re-designs, major feature shuffling, etc.

Re: Comparing how security experts and non-experts stay safe online

#104

Post by JupiterMoon » Thu, Jul 23, 2015, 9:33 PM UTC

avn2109 wrote: post #84

sgc wrote: post #68

Earlier quoted context omitted.

As long as you aren't constantly bricking/breaking things, as has happened to me with updates from Windows 8 and Office.

It's not just MS, I'm pretty sure every Ubuntu OS update from Hardy to Lucid destroyed 1) my video configuration and 2) one other large thing and 3) 20 little things

It's also Apple the yearly OS update is a matter of crossing fingers and hoping for me.

Re: Comparing how security experts and non-experts stay safe online

#105

Post by dzhiurgis » Thu, Jul 23, 2015, 10:19 PM UTC

modeless wrote: post #80

scholia wrote: post #79

Earlier quoted context omitted.

It's more reliable to install patches as part of a reboot because you know what's loaded and where it is. When you have 1.6 billion users with such disparate hardware and software, even a small improvement can help tens of millions of users. I expect Microsoft has lots of telemetry on this....

When you have 1.6 billion users, every time you waste 5 minutes of their time installing updates and rebooting, that wastes 190 human lifetimes worth of man-hours. I know that Microsoft does not properly account for this when deciding how much effort to allocate to making updates less intrusive.

Windows lost my unsaved files few times this month.

Re: Comparing how security experts and non-experts stay safe online

#106

Post by kyboren » Thu, Jul 23, 2015, 10:19 PM UTC

djent wrote: post #60

tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

What should I use as a VM environment/OS? Obviously I know GNU/Linux distros, but if all I'm going to be doing is using Firefox, I don't want a 8GB+ VM file hogging space on my normal system. Right now, I only have a 256 GB SSD in my laptop, and have my VMs on an external hard drive, which when plugged in to use uses up 1 out of my 2 USB ports. I would love to browse in a VM if I could get away without using a ton of…

Check out Qubes: https://www.qubes-os.org/

You can use Fedora, Debian, Whonix, or Windows in "seamless" mode with minimal effort. It has a composable networking architecture (e.g. easy to make all a VM's traffic go through Tor, whose traffic in turn goes over a VPN). Disposable VMs are a native feature. Template VMs reduce duplication of /; Application VMs use a template VM with CoW / and their own persistent /home.

Qubes uses Fedora 20 for Dom0, so you get all the same graphics support as Fedora gives you.

Re: Comparing how security experts and non-experts stay safe online

#107

Post by cmurf » Thu, Jul 23, 2015, 10:24 PM UTC

I've had my mom use lastpass for a couple of years, and just recently enabled grid multifactor auth (free). The main thing about their multifactor options is you can optionally "trust" a computer and only do multifactor on it once. So she won't have to ever use multifactor, but it's mandatory elsewhere which essentially keeps everyone else out while not changing her workflow.

Re: Comparing how security experts and non-experts stay safe online

#108

Post by snowwrestler » Thu, Jul 23, 2015, 11:21 PM UTC

modeless wrote: post #80

scholia wrote: post #79

Earlier quoted context omitted.

It's more reliable to install patches as part of a reboot because you know what's loaded and where it is. When you have 1.6 billion users with such disparate hardware and software, even a small improvement can help tens of millions of users. I expect Microsoft has lots of telemetry on this....

When you have 1.6 billion users, every time you waste 5 minutes of their time installing updates and rebooting, that wastes 190 human lifetimes worth of man-hours. I know that Microsoft does not properly account for this when deciding how much effort to allocate to making updates less intrusive.

But these are not actual lifetimes. You can't kill people by updating a billion computers for the same reason you can't have a baby in one month with 9 women.

Re: Comparing how security experts and non-experts stay safe online

#109

Post by Florin_Andrei » Thu, Jul 23, 2015, 11:24 PM UTC

ploxiln wrote: post #103

Florin_Andrei wrote: post #90

Earlier quoted context omitted.

Exposing the whole update process to the end user is like exposing the innards of the car's engine to the driver. There's no need to do that. They don't need to be aware of it. It should be just part of the daily magic to them, the stuff that keeps things running even though they don't understand how it happens or are not even aware of it. Of course, the intricacies of the process should still be exposed to the techn…

... but you can't avoid exposing the fact that the application substantially changed with no advance notice or control, because today's updates are not just security / bug fixes but also UI re-designs, major feature shuffling, etc.

If you do it right, the users will perceive it as free upgrades.

Re: Comparing how security experts and non-experts stay safe online

#110

Post by scintill76 » Fri, Jul 24, 2015, 12:33 AM UTC

joosters wrote: post #98

Florin_Andrei wrote: post #91

Earlier quoted context omitted.

> But are the security experts actually safer online? s/security experts/technical users/ Yes, we are. Whenever you see a laptop full of malware, that's a non-technical user. We're not safe from it entirely, nobody is 100% safe, but we're in much better shape than the regular folks.

Citation needed! Not just being pedantic here for the sake of it, I think it would be good to know how much safer experts generally are. Just saying "we're better than them!" isn't very convincing or useful.

I'm skeptical too. "The experts", e.g. HBGary, get pwned worse than having a bunch of crapware on their desktop, but it's for the same types of mistakes:

"So what do we have in total? A Web application with SQL injection flaws and insecure passwords. Passwords that were badly chosen. Passwords that were reused. Servers that allowed password-based authentication. Systems that weren't patched. And an astonishing willingness to hand out credentials over e-mail, even when the person being asked for them should have realized something was up. [...]

Most frustrating for HBGary must be the knowledge that they know what they did wrong, and they were perfectly aware of best practices; they just didn't actually use them. Everybody knows you don't use easy-to-crack passwords, but some employees did. Everybody knows you don't re-use passwords, but some of them did. Everybody knows that you should patch servers to keep them free of known security flaws, but they didn't." [1]

Granted, this doesn't prove that experts are generally unsafe, and maybe somebody with a beef with these ones in particular would say they're just semi-knowledgeable salesmen cashing in on the cyber scare, but it lends some weight to the idea that too many experts aren't much safer.

[1] http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-...