5 ms·

If a file on your computer is being used by a program to send information to someone, the answer isn't to destroy/randomize the file and break other application

If a file on your computer is being used by a program to send information to someone, the answer isn't to destroy/randomize the file and break other applications, the answer is to not use the program that is sending your information somewhere.

mirimir 8y ago
Sure, but how do you know what programs are misusing it?
- btown 8y ago
  This speaks to a more general need for user-friendly audit logs of which resources are accessed by which programs. I should be able to tell on any platform if Spotify called fopen on something in my documents folder.
  - nickysielicki 8y ago
    I think this is largely possible with eBPF, if you cared enough.
  - auslander 8y ago
    SELinux or app-armor, keep it in enforcing mode.
- jlgaddis 8y ago
  auditd(8)
  - mirimir 8y ago
    Thanks. https://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/ https://security.blogoverflow.com/2013/01/a-brief-introducti...
- yellowapple 8y ago
  Rename it and see which programs complain :)
0815test 8y ago
Or sandbox the program so that it sees a "safe" version of that information.
ez7r6i 8y ago
Chromium reads it, but are we sure it's sending it somewhere? Maybe it uses it for bookkeeping of local sessions or something like that.
- koolba 8y ago
  I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. Interestingly for Windows they pull the machine id from the registry[1] and (at first glance) it doesn't seem like they're doing any hashing. The raw value gets used. Haven't checked if the value gets sent externally but based upon the comment on the Linux code I'd bet it's a yes. [0]: https://github.com/chromium/chromium/blob/aae20fb7d3616de40e2af077bb02aaecb2b13d7f/chrome/browser/policy/browser_dm_token_storage_linux.cc#L89-L111 https://github.com/chromium/chromium/blob/aae20fb7d3616de40e... [1]: https://github.com/chromium/chromium/blob/01a03aab2d89c93c157c9af52dca7ac20d8ed96b/chrome/browser/policy/browser_dm_token_storage_win.cc#L129-L148 https://github.com/chromium/chromium/blob/01a03aab2d89c93c15...
  - jolmg 8y ago
    > I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. /etc/machine-id seems to be a random value. What purpose does hashing it before sending it do? The hash should still uniquely identify a machine. Am I missing something? Kind of makes me think that it's just done so people say "it's ok, because they're hashing it first, so it's secure!", while in reality hashing doesn't do anything to alleviate any concern.
    - MaulingMonkey 8y ago
      > Am I missing something? The source code links https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id.... mentions hashing using an "application-specific key", which would at least make it not correlatable between different apps (so $WEBSITE can't correlate machine IDs with $WELL_BEHAVED_APP 's machine IDs.) But either I'm missing something, or Chromium is - it looks like it's straight up hashing the file and not actually using any application-specific keys!
JohnFen 8y ago
But what faster way to discover which applications to remove than by deleting /etc/machine-id?

mirimir 8y ago

Sure, but how do you know what programs are misusing it?

btown 8y ago
This speaks to a more general need for user-friendly audit logs of which resources are accessed by which programs. I should be able to tell on any platform if Spotify called fopen on something in my documents folder.
- nickysielicki 8y ago
  I think this is largely possible with eBPF, if you cared enough.
- auslander 8y ago
  SELinux or app-armor, keep it in enforcing mode.
jlgaddis 8y ago
auditd(8)
- mirimir 8y ago
  Thanks. https://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/ https://security.blogoverflow.com/2013/01/a-brief-introducti...
yellowapple 8y ago
Rename it and see which programs complain :)

0815test 8y ago

Or sandbox the program so that it sees a "safe" version of that information.

ez7r6i 8y ago

Chromium reads it, but are we sure it's sending it somewhere? Maybe it uses it for bookkeeping of local sessions or something like that.

koolba 8y ago
I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. Interestingly for Windows they pull the machine id from the registry[1] and (at first glance) it doesn't seem like they're doing any hashing. The raw value gets used. Haven't checked if the value gets sent externally but based upon the comment on the Linux code I'd bet it's a yes. [0]: https://github.com/chromium/chromium/blob/aae20fb7d3616de40e2af077bb02aaecb2b13d7f/chrome/browser/policy/browser_dm_token_storage_linux.cc#L89-L111 https://github.com/chromium/chromium/blob/aae20fb7d3616de40e... [1]: https://github.com/chromium/chromium/blob/01a03aab2d89c93c157c9af52dca7ac20d8ed96b/chrome/browser/policy/browser_dm_token_storage_win.cc#L129-L148 https://github.com/chromium/chromium/blob/01a03aab2d89c93c15...
- jolmg 8y ago
  > I checked the Chromium source and for Linux they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value. /etc/machine-id seems to be a random value. What purpose does hashing it before sending it do? The hash should still uniquely identify a machine. Am I missing something? Kind of makes me think that it's just done so people say "it's ok, because they're hashing it first, so it's secure!", while in reality hashing doesn't do anything to alleviate any concern.
  - MaulingMonkey 8y ago
    > Am I missing something? The source code links https://www.freedesktop.org/software/systemd/man/machine-id.html https://www.freedesktop.org/software/systemd/man/machine-id.... mentions hashing using an "application-specific key", which would at least make it not correlatable between different apps (so $WEBSITE can't correlate machine IDs with $WELL_BEHAVED_APP 's machine IDs.) But either I'm missing something, or Chromium is - it looks like it's straight up hashing the file and not actually using any application-specific keys!

JohnFen 8y ago

But what faster way to discover which applications to remove than by deleting /etc/machine-id?