Comparing how security experts and non-experts stay safe online • Hacker News Board

Re: Comparing how security experts and non-experts stay safe online

#111

Post by pixl97 » Fri, Jul 24, 2015, 1:07 AM UTC

scintill76 wrote: post #110

joosters wrote: post #98

Earlier quoted context omitted.

Citation needed! Not just being pedantic here for the sake of it, I think it would be good to know how much safer experts generally are. Just saying "we're better than them!" isn't very convincing or useful.

I'm skeptical too. "The experts", e.g. HBGary, get pwned worse than having a bunch of crapware on their desktop, but it's for the same types of mistakes: "So what do we have in total? A Web application with SQL injection flaws and insecure passwords. Passwords that were badly chosen. Passwords that were reused. Servers that allowed password-based authentication. Systems that weren't patched. And an astonishing willin…

Experts in what?

Where I work the actual IT staff/server admins are pretty safe. They update, patch, and in general choose good passwords.

The programmers... ugh, good lord. They have the worst practices ever.

Re: Comparing how security experts and non-experts stay safe online

#112

Post by jcrawfordor » Fri, Jul 24, 2015, 6:39 AM UTC

S4M wrote: post #37

tptacek wrote: post #9

Earlier quoted context omitted.

No. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience. (I hate VMs so much I just use two computers).

How about using two browsers? one of emails or banking and another one for regular browsing?

Most of the banking-information-malware I take a look at hooks multiple browsers from the OS. So the browsers would need to be isolated in a better way than just being different browsers.

Using an uncommon browser for something like banking (Opera or Vivaldi or something) would be a pretty good solution because no one would have bothered to develop the hooks for them, unless the malware is keylogging, which is not uncommon but less popular now than the smarter solution of watching browser form submits on known bank websites.

Re: Comparing how security experts and non-experts stay safe online

#113

Post by jcrawfordor » Fri, Jul 24, 2015, 6:45 AM UTC

JupiterMoon wrote: post #7

Do security experts place less emphasis on virus scans because they do their browsing on OS for which virus scanning is less important? EDIT This question is partly motivated by wondering if a Linux browsing user should be running a virus scanner?

In my personal and professional experience, A/V is effective but not in the way you might think. A/V has a very good detection and quarantine rate for situations where the infection vector is bloody obvious. When you open the .zip attachment to that email and then go right on ahead and run the .exe inside, that's when a good A/V product will save you.

What I'm saying is that I view A/V as protection from users, not from malicious actors. In a corporate environment with mixed-skill users, A/V is key. On my own devices, I don't frequently get into situations where A/V would be effective, the threats that are more likely to get me are more sophisticated.

This isn't to say that I don't have Windows Defender enabled, but I don't see a value return in purchasing a commercial product.

Re: Comparing how security experts and non-experts stay safe online

#114

Post by jcrawfordor » Fri, Jul 24, 2015, 6:54 AM UTC

georgerobinson wrote: post #45

tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

Just to be clear, do you browse and read email in a virtual-machine or is this statement referring to the behaviours of security researchers more generally? If so, have you ever forgot to use the virtual machine and instead browsed or read email on your host operating system? If so, what did you do? Furthmore, is it possible to break out of the hypervisor and into the host operating system?

Your last question is really, really interesting. The answer is yes in at least one case (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0923), but I'm not aware of any real in-the-wild behavior of this sort (that is, not just basically a PoC of that vuln).

Note that that vuln is related to shared directories - anyone using a VM for isolation should probably not use these. I recently heard an amusing story of another infosec professional that cryptowalled their Macbook by testing on a VM with over-generous folder shares. Of course this is an extreme example caused by a clear mistake, but it's food for thought.

Re: Comparing how security experts and non-experts stay safe online

#115

Post by scintill76 » Fri, Jul 24, 2015, 7:13 AM UTC

pixl97 wrote: post #111

scintill76 wrote: post #110

Earlier quoted context omitted.

I'm skeptical too. "The experts", e.g. HBGary, get pwned worse than having a bunch of crapware on their desktop, but it's for the same types of mistakes: "So what do we have in total? A Web application with SQL injection flaws and insecure passwords. Passwords that were badly chosen. Passwords that were reused. Servers that allowed password-based authentication. Systems that weren't patched. And an astonishing willin…

Experts in what? Where I work the actual IT staff/server admins are pretty safe. They update, patch, and in general choose good passwords. The programmers... ugh, good lord. They have the worst practices ever.

Well, my example of HBGary was chosen because they were a firm specializing in computer security. But, as shown by Ars Technica (or claimed by Anonymous) they had some pretty bad security failures themselves.

You do have a point about programmers, or to generalize a bit, people who are more technically-inclined than average but who don't care/know about security. I shake my head seeing things like people flashing community-built Android ROMs with signature checks disabled, closed-source rooting tools, sideloaded APKs downloaded from dubious filesharing sites, "curl http://whatever | sh".

Re: Comparing how security experts and non-experts stay safe online

#116

Post by blub » Fri, Jul 24, 2015, 9:48 AM UTC

Florin_Andrei wrote: post #109

ploxiln wrote: post #103

Earlier quoted context omitted.

... but you can't avoid exposing the fact that the application substantially changed with no advance notice or control, because today's updates are not just security / bug fixes but also UI re-designs, major feature shuffling, etc.

If you do it right, the users will perceive it as free upgrades.

And how does one do it right? This seems like a dismissive defense for a very legitimate concern.

Re: Comparing how security experts and non-experts stay safe online

#117

Post by tim333 » Fri, Jul 24, 2015, 10:24 AM UTC

modeless wrote: post #82

tim333 wrote: post #81

Earlier quoted context omitted.

Even Chrome with it's "updating automatically and completely silently" needs restarting occasionally. It nagged me to do it just now.

That's true; however Chrome restarts in a couple of seconds and restores most of your state. Also, all of the work of installing the update is done before it prompts you to do anything. None of that is true for Windows.

I actually timed it and it was 16 seconds for me but it was pretty slick and I had a bunch of windows open.

Re: Comparing how security experts and non-experts stay safe online

#118

Post by rawTruthHurts » Fri, Jul 24, 2015, 2:27 PM UTC

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

> is the right thing to do

Well, upgrading often equals bloating and not all of us want to be updating their computer every two years. That added to what's been said in this thread means no, is not the right thing to do.

Re: Comparing how security experts and non-experts stay safe online

#119

Post by iulia_ion » Sat, Jul 25, 2015, 4:29 AM UTC

joosters wrote: post #26

But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices. If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...

The truth is that we don't know if security experts are actually safer. Maybe the fact that they are experts makes them more confident that they can deal with an incident if such a thing arises. So it might be that they take more risks, but then are simply better at fixing things when they break.

We also don't have a ground truth for what users should do to stay safe online. Do updates work better than a strong password? Measuring the effectiveness of different security actions as scale is so challenging, that we don't now how to do it.

Re: Comparing how security experts and non-experts stay safe online

#120

Post by iulia_ion » Sat, Jul 25, 2015, 4:32 AM UTC

joosters wrote: post #57

dublinben wrote: post #48

Earlier quoted context omitted.

It depends on what your definition of safety is. The perspective of this paper probably relates to compromised accounts and information leaks, not adware infections.

I haven't completely read the full paper yet (it's pretty big), but in a brief scan, I can't actually find any definition they use for staying safe. They talk about 'protecting their security online' and 'to stay safe online', however I didn't spot anything more specific. As you point out, there are a variety of attacks and big differences between e.g. leaking a password or getting a virus infection. But since their…

We did not provide a definition of what "staying safe online" means. As a result, some participants might have thought more of protecting online accounts, while others focussed on keeping their systems from getting compromised, etc. But coming from a non-technical user the question would be likely to be framed just like that: vague, because users don't know what the biggest threats are and what they should defend from first.