7 ms·

It's always nice to get a good healthy dose of paranoia in the morning. This makes me think back to how my sec professor had a separate system that he'd use to

by kache_ 7y ago

It's always nice to get a good healthy dose of paranoia in the morning. This makes me think back to how my sec professor had a separate system that he'd use to access his online banking.

Topgamer7 7y ago
What kind of system?
- kache_ 7y ago
  A linux toaster
  - daveslash 7y ago
    It toasted linux!? (I'm okay being downvoted a little for that...)
  - sansnomme 7y ago
    Elaborate?
    - na85 7y ago
      "toaster" is pretty common argot for "low-power computer"
      - jermaustin1 7y ago
        that seems kind of oxy-moronic? aren't toasters horribly energy hungry?
        wongarsu 7y ago
        I would have defined toaster as "slow, horribly outdated computer". That also fits your toaster comparison since old computers are very energy hungry compared to similarly speced modern computers.
        colanderman 7y ago
        The comparison is in the computing power needed to control a toaster, not to toast the toast.
      - mnw21cam 7y ago
        I have a white EeePC 901. While I was still using it as my carry-around laptop, it was called "Toastie", because it looked kind of like a sandwich toaster.
      - athenot 7y ago
        After the Power Mac g4 cube came out, that form factor became a trend for a little while. https://i1.wp.com/www.mac-ave.com/wp-content/uploads/2016/11/apple_mac_g4_cube_1.jpg?fit=728%2C728&ssl=1 https://i1.wp.com/www.mac-ave.com/wp-content/uploads/2016/11...
      - nonbirithm 7y ago
        I immediately thought of this: https://www.embeddedarm.com/blog/netbsd-toaster-powered-by-the-ts-7200-arm9-sbc/ https://www.embeddedarm.com/blog/netbsd-toaster-powered-by-t... It's an actual toaster running NetBSD.
gruez 7y ago
To be honest, that's probably overboard. You're pretty much never liable for fraudulent fiat transactions. Crypto on the other hand...
- noxToken 7y ago
  Part of the fallout from fraud isn't being afraid of losing money. Banks and credit unions are generally on your side when it comes to disputing fraudulent charges. The hassle is getting it all sorted out - verifying identity with sometimes completely inept telephone reps, replacing cards, entering new payment information for recurring charges, etc.
  - gruez 7y ago
    On the other hand, there's also a cost to taking security measures. The time needed to maintain/switch to that separate system has a cost. There's a study[1] on this, but it's done with simple security measures with an unrealistically high probability of getting hacked. [1] https://arxiv.org/abs/1805.06542 https://arxiv.org/abs/1805.06542
- hackinthebochs 7y ago
  I've heard of at least one case where money was transferred out of someone's bank account through online banking and he was held liable. The user claimed fraud but since the intruder used his username and password the bank refused to refund the money claiming he had a responsibility to secure his username and password.
  - gruez 7y ago
    >since the intruder used his username and password the bank refused to refund the money claiming he had a responsibility to secure his username and password what jurisdiction is this? this seems like the worse consumer protection law ever.
    - hackinthebochs 7y ago
_jal 7y ago
I use a dedicated VM. It is only started when I need to do some banking, and can't talk to most of the internet.
- gelsoles 7y ago
  I don't get it, shouldn't you use the VM for accessing everything except your bank? If the host gets compromised from non-banking activity, it can just take over your VM.
  - Scoundreller 7y ago
    My “solution” is that the VM is a different OS, amplifying the resources required to attack me beyond worth.
  - _jal 7y ago
    Almost all of my activity on that machine is in one VM or another. I mostly only work on the host OS when I'm making a new VM.
dunnevens 7y ago
These days I'm doing something similar. Using only my iOS devices, and my Chromebook, for sensitive sites. On the Chromebook, I take it a step further by using the Android version of Firefox Focus. In theory, that gives me both the inherent security of Chrome OS, and security of the OS's Android container. Almost a poor man's version of Qubes OS in a way. I'm not sure this is the best approach, and I'm becoming less comfortable with Google and Chrome OS on general principles, but I do feel more secure with iOS and Chrome OS than I do with general purpose computing devices.

by kache_ 7y ago

It's always nice to get a good healthy dose of paranoia in the morning. This makes me think back to how my sec professor had a separate system that he'd use to access his online banking.

Topgamer7 7y ago

What kind of system?

kache_ 7y ago
A linux toaster
- daveslash 7y ago
  It toasted linux!? (I'm okay being downvoted a little for that...)
- sansnomme 7y ago
  Elaborate?
  - na85 7y ago
    "toaster" is pretty common argot for "low-power computer"
    - jermaustin1 7y ago
      that seems kind of oxy-moronic? aren't toasters horribly energy hungry?
      - wongarsu 7y ago
        I would have defined toaster as "slow, horribly outdated computer". That also fits your toaster comparison since old computers are very energy hungry compared to similarly speced modern computers.
      - colanderman 7y ago
        The comparison is in the computing power needed to control a toaster, not to toast the toast.
    - mnw21cam 7y ago
      I have a white EeePC 901. While I was still using it as my carry-around laptop, it was called "Toastie", because it looked kind of like a sandwich toaster.
    - athenot 7y ago
      After the Power Mac g4 cube came out, that form factor became a trend for a little while. https://i1.wp.com/www.mac-ave.com/wp-content/uploads/2016/11/apple_mac_g4_cube_1.jpg?fit=728%2C728&ssl=1 https://i1.wp.com/www.mac-ave.com/wp-content/uploads/2016/11...
    - nonbirithm 7y ago
      I immediately thought of this: https://www.embeddedarm.com/blog/netbsd-toaster-powered-by-the-ts-7200-arm9-sbc/ https://www.embeddedarm.com/blog/netbsd-toaster-powered-by-t... It's an actual toaster running NetBSD.

gruez 7y ago

To be honest, that's probably overboard. You're pretty much never liable for fraudulent fiat transactions. Crypto on the other hand...

noxToken 7y ago
Part of the fallout from fraud isn't being afraid of losing money. Banks and credit unions are generally on your side when it comes to disputing fraudulent charges. The hassle is getting it all sorted out - verifying identity with sometimes completely inept telephone reps, replacing cards, entering new payment information for recurring charges, etc.
- gruez 7y ago
  On the other hand, there's also a cost to taking security measures. The time needed to maintain/switch to that separate system has a cost. There's a study[1] on this, but it's done with simple security measures with an unrealistically high probability of getting hacked. [1] https://arxiv.org/abs/1805.06542 https://arxiv.org/abs/1805.06542
hackinthebochs 7y ago
I've heard of at least one case where money was transferred out of someone's bank account through online banking and he was held liable. The user claimed fraud but since the intruder used his username and password the bank refused to refund the money claiming he had a responsibility to secure his username and password.
- gruez 7y ago
  >since the intruder used his username and password the bank refused to refund the money claiming he had a responsibility to secure his username and password what jurisdiction is this? this seems like the worse consumer protection law ever.
  - hackinthebochs 7y ago

_jal 7y ago

I use a dedicated VM. It is only started when I need to do some banking, and can't talk to most of the internet.

gelsoles 7y ago
I don't get it, shouldn't you use the VM for accessing everything except your bank? If the host gets compromised from non-banking activity, it can just take over your VM.
- Scoundreller 7y ago
  My “solution” is that the VM is a different OS, amplifying the resources required to attack me beyond worth.
- _jal 7y ago
  Almost all of my activity on that machine is in one VM or another. I mostly only work on the host OS when I'm making a new VM.

dunnevens 7y ago

These days I'm doing something similar. Using only my iOS devices, and my Chromebook, for sensitive sites. On the Chromebook, I take it a step further by using the Android version of Firefox Focus. In theory, that gives me both the inherent security of Chrome OS, and security of the OS's Android container. Almost a poor man's version of Qubes OS in a way. I'm not sure this is the best approach, and I'm becoming less comfortable with Google and Chrome OS on general principles, but I do feel more secure with iOS and Chrome OS than I do with general purpose computing devices.