4 ms·

That's why I use web-based email (FastMail and Proton Mail personally) because I want email software to exist in the same sandbox as all websites I visit on the

That's why I use web-based email (FastMail and Proton Mail personally) because I want email software to exist in the same sandbox as all websites I visit on the web.

sukilot 6y ago
Seems like a reason to use an OS with sandboxing.
- yjftsjthsd-h 6y ago
  A browser effectively is an OS with sandboxing.
  - smichel17 6y ago
    Yes, but it doesn't integrate with my native window manager.
    - pjmlp 6y ago
      Not with yours, but it does so with ChromeOS and Windows (as PWA).
- segfaultbuserr 6y ago
  I browse the web on QubesOS in a disposable VM. There's no user data in the disposable VM, and all the data is cleared when the browser is turned off. Also, QubesOS allows me to run my GnuPG daemon in a separate domain completely isolated from all other applications. This is the ultimate defense against arbitrary code execution in a buggy web browser. To take over the computer, the attacker must exploit the Xen hypervisor or a CPU side-channel, not just a 0day in Firefox or a PDF reader. Yes, QubesOS's approach is not pretty, it's a hack and resource-heavy. But this hack allowed us to continue using an existing insecure desktop system, device drivers and applications, without reinventing the OS and the desktop with its set-back of non-existent support. At least it's a very practical stop-gap measure before someone reinvents OS security. A lightweight solution I used previously was running the browser in a separate Unix user with firejail's sandbox. If it's not running a separate X server, the attacker is free to take over the X server and inject keyboard and mouse inputs, but at least the files in the primary /home directory is inaccessible. I did this a few years ago after the disclosure of a file-leaking vulnerability in Firefox, because I assumed similar exploits may be discovered in the future, apparently I'm not wrong.
  - boring_twenties 6y ago
    firejail does in fact run Firefox in a separate X server. Namely, your choice of Xpra or Xephyr.
    - segfaultbuserr 6y ago
      Comes with a great performance penalty, my (unverified) impression is that it's even slower than Qubes.
- pantalaimon 6y ago
  Usually you want your mail client to be able to attach files to mails.
- vortico 6y ago
  Most of the programs I use don't need sandboxing, so I don't need this. The programs that process arbitrary data people send me definitely need sandboxing, but luckily all of those are in the form of web apps such as webmail clients.
upofadown 6y ago
If you are using the Proton Mail javascript PGP client the browser would by necessity need to have access to your private key.
system2 6y ago
As much as I hate google, I use gmail for this only reason. Outlook or thunderbird was always buggy and never trusted them.

That's why I use web-based email (FastMail and Proton Mail personally) because I want email software to exist in the same sandbox as all websites I visit on the web.

sukilot 6y ago

Seems like a reason to use an OS with sandboxing.

yjftsjthsd-h 6y ago
A browser effectively is an OS with sandboxing.
- smichel17 6y ago
  Yes, but it doesn't integrate with my native window manager.
  - pjmlp 6y ago
    Not with yours, but it does so with ChromeOS and Windows (as PWA).
segfaultbuserr 6y ago
I browse the web on QubesOS in a disposable VM. There's no user data in the disposable VM, and all the data is cleared when the browser is turned off. Also, QubesOS allows me to run my GnuPG daemon in a separate domain completely isolated from all other applications. This is the ultimate defense against arbitrary code execution in a buggy web browser. To take over the computer, the attacker must exploit the Xen hypervisor or a CPU side-channel, not just a 0day in Firefox or a PDF reader. Yes, QubesOS's approach is not pretty, it's a hack and resource-heavy. But this hack allowed us to continue using an existing insecure desktop system, device drivers and applications, without reinventing the OS and the desktop with its set-back of non-existent support. At least it's a very practical stop-gap measure before someone reinvents OS security. A lightweight solution I used previously was running the browser in a separate Unix user with firejail's sandbox. If it's not running a separate X server, the attacker is free to take over the X server and inject keyboard and mouse inputs, but at least the files in the primary /home directory is inaccessible. I did this a few years ago after the disclosure of a file-leaking vulnerability in Firefox, because I assumed similar exploits may be discovered in the future, apparently I'm not wrong.
- boring_twenties 6y ago
  firejail does in fact run Firefox in a separate X server. Namely, your choice of Xpra or Xephyr.
  - segfaultbuserr 6y ago
    Comes with a great performance penalty, my (unverified) impression is that it's even slower than Qubes.
pantalaimon 6y ago
Usually you want your mail client to be able to attach files to mails.
vortico 6y ago
Most of the programs I use don't need sandboxing, so I don't need this. The programs that process arbitrary data people send me definitely need sandboxing, but luckily all of those are in the form of web apps such as webmail clients.

upofadown 6y ago

If you are using the Proton Mail javascript PGP client the browser would by necessity need to have access to your private key.

system2 6y ago

As much as I hate google, I use gmail for this only reason. Outlook or thunderbird was always buggy and never trusted them.