4 ms·

Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not cl

by tarr11 10y ago

Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not clumsy? Can't this be built into the OS so I don't actually have to do it?

perlgeek 10y ago
There are indeed approaches by Microsoft to run some IE edge processes in micro VMs. The hard part is figuring out how much communication to allow with the rest of the OS. Do you want to allow sites to set cookies? For every domain, or just for the target domain? If the latter, what happens with a cookie set after a redirect to a different domain? Do you want to allow downloads to reach the host OS? The more secure you make things, the more usability suffers, so you have to think really hard about all such problems.
- codedokode 10y ago
  I see no problem with downloads. Saving a file can be implemented with a helper that has access to disk but doesn't have other permissions (like accessing the network). The path to save a file is chosen by a user. The developers either care too much about compatibility with legacy software or just don't want to invest into implementing more secure environment. Patching existing software seems to be much cheaper.
codedokode 10y ago
Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux in recent years) and on Android the files on sdcard partition are not protected at all. But desktop OSes don't do anything at all to protect the user. They allow the user to run a program by just clicking a link in email or web browser and this program has full access to all their data as does the PDF viewer or Java plugin in a browser. The desktop operating systems still use security models from mainframe era.
- ndesaulniers 10y ago
  > So vulnerability in an image viewer would not give an attacker access to other apps' data. By having separate user's per app, apps can't read each others' files by default. If one app has a vulnerability that can be used to acquire root, that app can read all files after disabling SELinux.
  - codedokode 10y ago
    > If one app has a vulnerability that can be used to acquire root To get root privileges you need to attack the kernel (or the application that has those privileges). Having a bug in an image viewer is not enough. You can try to make obtaining root privileges more complicated only by reducing the attack surface with restricting system calls each application is allowed to make or with redesigning the kernel so that less code is executed in ring 0 (microkernel architecture). But recent vulnerabilities like Dirty COW or rowhammer could work even in this case.
MayeulC 10y ago
Qubes OS actually aims at this, if you're serious about security. Of course, there is absolutely no way to completely suppress any attack surface, but compartmentalization can help.
MadWombat 10y ago
I suppose you could run browser inside a docker container and use X11 or VNC to display it on your desktop...

by tarr11 10y ago

perlgeek 10y ago

There are indeed approaches by Microsoft to run some IE edge processes in micro VMs. The hard part is figuring out how much communication to allow with the rest of the OS. Do you want to allow sites to set cookies? For every domain, or just for the target domain? If the latter, what happens with a cookie set after a redirect to a different domain? Do you want to allow downloads to reach the host OS? The more secure you make things, the more usability suffers, so you have to think really hard about all such problems.

codedokode 10y ago
I see no problem with downloads. Saving a file can be implemented with a helper that has access to disk but doesn't have other permissions (like accessing the network). The path to save a file is chosen by a user. The developers either care too much about compatibility with legacy software or just don't want to invest into implementing more secure environment. Patching existing software seems to be much cheaper.

codedokode 10y ago

Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux in recent years) and on Android the files on sdcard partition are not protected at all. But desktop OSes don't do anything at all to protect the user. They allow the user to run a program by just clicking a link in email or web browser and this program has full access to all their data as does the PDF viewer or Java plugin in a browser. The desktop operating systems still use security models from mainframe era.

ndesaulniers 10y ago
> So vulnerability in an image viewer would not give an attacker access to other apps' data. By having separate user's per app, apps can't read each others' files by default. If one app has a vulnerability that can be used to acquire root, that app can read all files after disabling SELinux.
- codedokode 10y ago
  > If one app has a vulnerability that can be used to acquire root To get root privileges you need to attack the kernel (or the application that has those privileges). Having a bug in an image viewer is not enough. You can try to make obtaining root privileges more complicated only by reducing the attack surface with restricting system calls each application is allowed to make or with redesigning the kernel so that less code is executed in ring 0 (microkernel architecture). But recent vulnerabilities like Dirty COW or rowhammer could work even in this case.

MayeulC 10y ago

Qubes OS actually aims at this, if you're serious about security. Of course, there is absolutely no way to completely suppress any attack surface, but compartmentalization can help.

MadWombat 10y ago

I suppose you could run browser inside a docker container and use X11 or VNC to display it on your desktop...