Comparing how security experts and non-experts stay safe online • Hacker News Board

Re: Comparing how security experts and non-experts stay safe online

#71

Post by lucb1e » Thu, Jul 23, 2015, 5:16 PM UTC

joosters wrote: post #26

But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices. If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...

Very good question, but I'm not sure how you imagine this could be addressed.

Security experts may use a lot more password managers and want to use unique passwords, but you could say that's just because they have a lot more accounts than normal people. Most people have a couple accounts for social networking, their bank, perhaps a local library... experts usually work in the field, spend their days online in an office, and have lots of accounts for various tasks or activities.

The attack surface is very different: lots of accounts versus just a couple. Lots of time online browsing various sites versus browsing your average social network in spare time. Perhaps I'm overgeneralizing, but it probably matches a good percentage.

And then there is the definition of "safer" or "expert". Are you an expert when you got a degree in the field? When you followed some online courses? When you work in the field? Or when you read a lot about security?

Re: Comparing how security experts and non-experts stay safe online

#72

Post by lucb1e » Thu, Jul 23, 2015, 5:20 PM UTC

djent wrote: post #60

tptacek wrote: post #4

The thing that software security people do that most normal people don't do is: browsing and accessing email in a virtual machine, not their actual machine.

What should I use as a VM environment/OS? Obviously I know GNU/Linux distros, but if all I'm going to be doing is using Firefox, I don't want a 8GB+ VM file hogging space on my normal system. Right now, I only have a 256 GB SSD in my laptop, and have my VMs on an external hard drive, which when plugged in to use uses up 1 out of my 2 USB ports. I would love to browse in a VM if I could get away without using a ton of…

I used to use Crunchbang whenever I wanted a lightweight, easy and modern GNU/Linux virtual machine, but they seem to have pulled the plug.

Debian is what I'm most familiar with, so that's my new place to go. Still quite big with a relatively basic install, but not as big as Ubuntu or Linux Mint.

Really lightweight stuff is Damn Small Linux (old) or Puppy Linux (never tried it), but I'm not sure how usable that is for day-to-day tasks.

Re: Comparing how security experts and non-experts stay safe online

#73

Post by recursive » Thu, Jul 23, 2015, 5:22 PM UTC

JupiterMoon wrote: post #30

recursive wrote: post #21

Earlier quoted context omitted.

Anything that takes more than a dozen steps is not trivial.

If your using a Linux distro already you have to: 1. install virtual box from package manager 2. download .iso of some distro 3. install 4. update virtual machine 5. browse Of these someone who's installed their own OS has 2 slightly novel steps. So yeah trivial is maybe the wrong words but still easy.

> If your using a Linux distro

Most people aren't. I think most people haven't installed on OS at all for that matter.

Re: Comparing how security experts and non-experts stay safe online

#74

Post by patio11 » Thu, Jul 23, 2015, 5:29 PM UTC

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

I largely agree with you, but non-technical users have had the frequent experience of "I updated X and then X, Y, or Z broke." Sometimes they even have the causational arrow correct, too. Yesterday they had no problem with Word or hackers. Today, Word doesn't work, to protect them from hackers. "Thanks, geeks."

Or consider how non-technical users can come to associate installs/updates with Arbitrary Negative Consequences even without that being a reflection of reality.

Bingo Card Creator, back when it was downloadable, was accused of killing multiple hard drives every year. You and I know that is preposterous, but all the user knows is that the last consequential thing they did with their computer was install the update and now their machine is bricked.

(The user does not appreciate that the MTBF of laptop hard drives among BCC users is approximately 18 months and that since we'd accordingly be the last thing someone did before data loss at least once a day.)

At least one of these users contacted their IT department, whereupon they were warned in the sternest possible terms to never ever ever ever download anything from the Googles because that could erase all their memory and give their hard drive a virus. A lifetime of learned (and taught) helplessness like that adds up.

Re: Comparing how security experts and non-experts stay safe online

#75

Post by peterwwillis » Thu, Jul 23, 2015, 5:29 PM UTC

This seems misleading. Good security jerks know that there isn't a rule that works for everything. This list might be a little misleading to the non-security jerks.

For example, 'software updates' are half the battle, but the other half of the battle is configuring your software to be more secure (browser sandboxing, NoScript, pop-up blockers, malware detectors, OS hardening).

All the rest of the security concerns are authentication-based, but there are very few accounts that are important enough to need a secure account. Banks and money transfer services, business accounts (taxes, professional services, ebay/etsy merchants, etc), followed e-mail accounts, are probably the only really critical accounts most people have. You can hack my Facebook or my Huffington Post account; it doesn't really threaten my safety.

I think the one thing nobody does that would actually matter to them eventually is keep offline backups. Facebook might lose all your pictures and FB messages tomorrow. They have zero responsibility to keep that crap for you. If you do get hacked and someone deletes all your pictures, don't go crying to Facebook; they have enough problems.

At the end of the day, the biggest threat to your online safety in general is malware. Once malware is on your device it's game over.

Re: Comparing how security experts and non-experts stay safe online

#76

Post by joosters » Thu, Jul 23, 2015, 5:41 PM UTC

lucb1e wrote: post #71

joosters wrote: post #26

But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices. If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...

Very good question, but I'm not sure how you imagine this could be addressed. Security experts may use a lot more password managers and want to use unique passwords, but you could say that's just because they have a lot more accounts than normal people. Most people have a couple accounts for social networking, their bank, perhaps a local library... experts usually work in the field, spend their days online in an offi…

The paper acknowledges the problem in defining a security expert (see 5.1: Limitations)

Defining a security “expert” is challenging, and we settled upon a definition that is simple (5+ self-reported years of experience in the area)

Re: Comparing how security experts and non-experts stay safe online

#77

Post by bsilvereagle » Thu, Jul 23, 2015, 5:42 PM UTC

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

> And this is why Chrome's policy of updating automatically and completely silently is the right thing to do

Not everyone is hooked up to unlimited broadband 24/7. To anyone who is frequently jumping between capped satellite & 3G/4G networks, silent auto-updating software not only unexpectedly slows down your already non-ideal connection, but also eats up lots of your capped data.

Lots of services tend to forget about the users who aren't hooked up to broadband 100% of the time.

Re: Comparing how security experts and non-experts stay safe online

#78

Post by modeless » Thu, Jul 23, 2015, 5:55 PM UTC

gruez wrote: post #59

modeless wrote: post #49

[Non-experts] mistakenly worry that software updates are a security risk. I think this betrays a lack of thought about the risks to non-experts. Tons of malware masquerades as legitimate updates, and non-experts don't always have the knowledge to distinguish legitimate updates from malicious ones. Therefore, to non-experts software updates are a security risk. Edit: And this is why Chrome's policy of updating automat…

>Microsoft With windows 10 they're doing forced updates for home editions, so there's that.

But are they doing silent updates? Any update that requires a reboot is not silent, and as far as I can see there's been no progress in silent updating since Windows 7. It is definitely possible to patch vulnerabilities in memory without rebooting my computer; heck, most malware will silently patch the vulnerability it used as part of the infection process; Microsoft just can't be bothered to do it themselves.

Re: Comparing how security experts and non-experts stay safe online

#79

Post by scholia » Thu, Jul 23, 2015, 6:05 PM UTC

modeless wrote: post #78

gruez wrote: post #59

Earlier quoted context omitted.

>Microsoft With windows 10 they're doing forced updates for home editions, so there's that.

But are they doing silent updates? Any update that requires a reboot is not silent, and as far as I can see there's been no progress in silent updating since Windows 7. It is definitely possible to patch vulnerabilities in memory without rebooting my computer; heck, most malware will silently patch the vulnerability it used as part of the infection process; Microsoft just can't be bothered to do it themselves.

It's more reliable to install patches as part of a reboot because you know what's loaded and where it is.

When you have 1.6 billion users with such disparate hardware and software, even a small improvement can help tens of millions of users.

I expect Microsoft has lots of telemetry on this....

Re: Comparing how security experts and non-experts stay safe online

#80

Post by modeless » Thu, Jul 23, 2015, 6:11 PM UTC

scholia wrote: post #79

modeless wrote: post #78

Earlier quoted context omitted.

But are they doing silent updates? Any update that requires a reboot is not silent, and as far as I can see there's been no progress in silent updating since Windows 7. It is definitely possible to patch vulnerabilities in memory without rebooting my computer; heck, most malware will silently patch the vulnerability it used as part of the infection process; Microsoft just can't be bothered to do it themselves.

It's more reliable to install patches as part of a reboot because you know what's loaded and where it is. When you have 1.6 billion users with such disparate hardware and software, even a small improvement can help tens of millions of users. I expect Microsoft has lots of telemetry on this....

When you have 1.6 billion users, every time you waste 5 minutes of their time installing updates and rebooting, that wastes 190 human lifetimes worth of man-hours. I know that Microsoft does not properly account for this when deciding how much effort to allocate to making updates less intrusive.