27 ms·
Security theatre. If your browser is attacked by an 0day of any sort, or malware or whatever, it will have access to the shared credentials and information insi
by aseipp 5y ago
Security theatre. If your browser is attacked by an 0day of any sort, or malware or whatever, it will have access to the shared credentials and information inside your browser. This means any and all cookies, shared logins, account access, tab information — is all game. That's where all the actual value is; why would I care if it's inside a VM or not when I can get credentials to your mail provider from the browser itself and just exfiltrate? It doesn't matter if you restart the browser once or a million times; anytime it has sensitive information, it is a target. Unless you plan to literally restart/wipe after every interaction with every domain in a separate same-origin policy where any sensitive information exposure occurs.
But if you're that careful, what is the VM really doing for you, and why the hell are you even exposing yourself that much? Just use Lynx or something.
The real solution is this: Install Firefox, install noscript to nuke all javascript, install ublock too, and get a password manager. Selectively allow any webpage interactivity, as necessary. The world isn't a Tom Clancy novel so you don't actually need to do anything more than this to be very secure and on top of almost all active threats.
Ultimately to achieve what we all actually want (strong isolation guarantees that would prevent a full browser exploit from both A) your SSH keys from getting stolen and B) also your gmail spool from being attacked, and let's be honest, B is the worst case scenario) requires a rethinking of the fundamental software stack from OS to user-visible applications. No amount of Browsers-in-a-VM are a substitute.
- 0000011111 5y agoI just use a 2 factor authentication app.
- aseipp 5y agoThat doesn't protect any active sessions; if you assume the attacker is capable of exploiting the browser, then they can just exfiltrate an active session for the user for any domain and bypass the login mechanism entirely. Done. This "reset state" approach can only protect against that if you completely wipe after every sensitive interaction on every unique same-origin policy, but at that point you're just doing all the hard work yourself. Obviously I'm not saying 2FA isn't good, and doesn't mitigate some clearly related attacks like raw credential theft (whether or not the browser is exploited, obviously.) My position is just that browsers-in-VMs is a mostly roundabout threat model whose actual benefits (such as some semblance of filesystem isolation) can be achieved other ways. The things these approaches can not fix are otherwise systematic issues that require major redesigns to achieve.
- amiircoal 5y ago> My position is just that browsers-in-VMs is a mostly roundabout threat model whose actual benefits (such as some semblance of filesystem isolation) can be achieved other ways. What other ways would you recommend for filesystem isolation better than simply immutable VM running a web browser?
- wintermutestwin 5y agoVM#1: Use only for browsing sensitive sites (banking, etc) VM#2: Use for everything else Maybe I'm missing something, but I'd love to know why this doesn't make good sense. Each VM is isolated from the others and also from the host OS.
- tobyjsullivan 5y agoI don’t know if it will work in your MacOS host but I think you’re looking for Qubes OS. https://www.qubes-os.org/ https://www.qubes-os.org/
- qaq 5y agoThats pretty much what top tier security people I know do.
- amiircoal 5y ago> Security theatre. If your browser is attacked by an 0day of any sort, or malware or whatever, it will have access to the shared credentials and information inside your browser. Yes running a VM won’t protect against this threat. Running a VM will pretty much eliminate that 0-day from infecting the host OS, where it could become a persistent threat and have access to a range of sensitive data. This is not security theatre. You just have incomplete threat modelling here. https://www.securityweek.com/chrome-sandbox-escape-vulnerability-earns-researchers-20000 https://www.securityweek.com/chrome-sandbox-escape-vulnerabi... Web browser sandbox escape just by viewing a HTML page. Not common, but it happens.
- deleted 5y ago[deleted]
- gzer0 5y agoWe need to take a step back and remember that Facebook paid for a 0 day exploit in the Tails OS to catch a criminal [1]. Note, I'm not commenting on the morality of this, I'm only commenting that one can never really be "secure" even if using the most secure of protocols. FWIW, this is an interesting read. [1] https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-for-a-0-day-to-help-fbi-unmask-child-predator/ https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-fo...
- crtasm 5y agoWhat protocol are you referring to? Tails makes a lot of great efforts to prevent undesired network access but at the end of the day it doesn't do any isolation by virtualisation and the bundled video player was able to ping a server directly. I don't believe this approach would be possible against Qubes OS.
- raverbashing 5y agoThe easiest way of getting security wrong is assuming it's all or nothing. This is a very common error I see here. Security is about risk management and levels of protection. Saying locking your door is useless because someone might drive a car through is not going to help anything.
- DavideNL 5y agoExactly... it's also a common cognitive distortion people have in general: "black and white thinking" https://en.wikipedia.org/wiki/Splitting_(psychology) https://en.wikipedia.org/wiki/Splitting_(psychology)