4 ms·

(Disclaimer: I work on ChromeOS at Google) I would let anyone, even a total stranger, use my Chromebook in guest mode without a second thought (as long as I am

(Disclaimer: I work on ChromeOS at Google) I would let anyone, even a total stranger, use my Chromebook in guest mode without a second thought (as long as I am reasonably sure they won’t steal it, break it, or disassemble it).

wyldfire 4y ago
I guess in practice this doesn't come up often. but it's a powerful testament to your confidence in ChromeOS' security. You are implying that you don't feel the same way about a Linux user guest login. But why? What additional security measures are present in ChromeOS that are missing from popular Linux distros? I don't doubt the features are there, I'm genuinely curious what they are.
- kweingar 4y ago
  You can harden and configure a Linux system to have many of the ChromeOS security features, but ChromeOS has all of these enabled by default: - All user data is encrypted at the login level. A guest user cannot access any other users’ data. Whereas in Ubuntu, for example, home directories have 755 permissions. - The Linux userspace in ChromeOS is actually running on KVM, so ChromeOS itself is insulated from user-installed malware. - Verified boot is huge. It is theoretically impossible for a modification to system-level software to survive a reboot. An attacker would have to modify the hardware too. And even if someone stole your Chromebook and modified the hardware to run malware, your data is still encrypted. If you are interested, a more thorough explanation can be found here: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/security/chromeos_security_whitepaper.md#going-beyond-the-browser https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sec...
  - cmatthias 4y ago
    What if the attacker is the one who built and shipped the OS to begin with? Everything you say is true, but it doesn't matter as long as user data (history, location, etc) is being shipped off to Google. Or, put another way: your threat model is a nefarious hacker or three-letter-agency who might secretly modify your hardware/software to get your data. Mine is surveillance capitalism. ChromeOS is secure under your threat model, but is _built by the attacker_ under mine. Both of these threat models are important to consider, but one is much more relevant to a larger portion of the population than the other.
    - sulam 4y ago
      Relevant from your POV. A very large part of the planet clearly doesn't care.
      - cmatthias 4y ago
        I said it was more relevant than nefarious hackers or government agencies, not relevant in some subjective general sense. So whether or not they care is irrelevant to my point.
javawizard 4y ago
(Disclaimer: I also work at Google but not directly on ChromeOS.) Exactly. I would never let my (non-tech savvy) grandparents near a Linux machine without supervision, but I wouldn't hesitate to let them near a Chromebook in guest mode. Linux is quite secure in the hands of an experienced user. ChromeOS is secure in the hands of anyone who's not state sponsored attacker-adjacent.
- quicklime 4y ago
  It's not quite the same as "guest mode" on ChromeOS, but I make user accounts (no sudo) for non-technical family members and let them use my machines unsupervised. What are you worried about here? Should I be worried?
  - kweingar 4y ago
    It depends on how much you trust your family members and whether you worry about non-root malware. Looking at my Linux machine, I notice that the default permission for home directories is 755. If I don’t think to tweak that, then I’m potentially exposing a lot of sensitive data to other users (and potentially the programs they run). I’m a proficient Linux user but not an expert, and I’m racking my brains to think of what else might be exposed to other users on my machine.
    - bravetraveler 4y ago
      I'm similarly racking my brain, and I came to the same finding. 755 permissions on the home directory lets others see what you have, which isn't great. The good and bad news is, permissions on the files matter too. SSH (private) keys for example categorically won't work outside of 600 permissions, meaning nobody else can read your private key - without escalating privileges Now, if you go defining auth secrets in your shell profile (which is world-readable by default), probably something to reconsider. Restricting umask is a good protection for this, for what it's worth. You can make it so that newly created files/directories are not accessible to the world
    - kelnos 4y ago
cmatthias 4y ago
Would you be at all concerned about the security and privacy of your guest user’s data, given your employer’s propensity for slurping up and storing whatever user data they can get their hands on? What if your guest user was searching for terms related to abortion in a US state where that procedure is (or will shortly be) illegal? What if they’re doing that and you happen to be physically near a provider of abortions?[1] Security does not only mean security of your own data stored on the device. A device made by Google will never be secure. [1] https://www.politico.com/news/2022/07/18/google-data-states-track-abortions-00045906 https://www.politico.com/news/2022/07/18/google-data-states-...
- kweingar 4y ago
  The host operating system does not give me more or less confidence in the security of a guest user’s web browsing data.
  - cmatthias 4y ago
    Then you are either uninformed or willfully ignorant of 1) how operating systems and browsers work and 2) your employer's past actions relating to collecting and storing user data.
    - kweingar 4y ago
      I am uninformed as to how running a Google search as a guest user on ChromeOS has different privacy implications that running that same search using another operating system. Sure, if I carried around a privacy-centric Linux box and told my guest to use Tor browser, I could see how that could change the privacy picture. But that isn’t exactly an apples-to-apples comparison. If you believe that having the guest user run their search on a typical Linux, Windows, or macOS machine would be better for their privacy, I would be interested to hear how. Also, if they’re running the search in guest mode and they don’t log into a Google account, nobody can know who’s making the search. It’s not like they’re looking through the webcam or something.
      - 4y ago

wyldfire 4y ago

I guess in practice this doesn't come up often. but it's a powerful testament to your confidence in ChromeOS' security. You are implying that you don't feel the same way about a Linux user guest login. But why? What additional security measures are present in ChromeOS that are missing from popular Linux distros? I don't doubt the features are there, I'm genuinely curious what they are.

kweingar 4y ago
You can harden and configure a Linux system to have many of the ChromeOS security features, but ChromeOS has all of these enabled by default: - All user data is encrypted at the login level. A guest user cannot access any other users’ data. Whereas in Ubuntu, for example, home directories have 755 permissions. - The Linux userspace in ChromeOS is actually running on KVM, so ChromeOS itself is insulated from user-installed malware. - Verified boot is huge. It is theoretically impossible for a modification to system-level software to survive a reboot. An attacker would have to modify the hardware too. And even if someone stole your Chromebook and modified the hardware to run malware, your data is still encrypted. If you are interested, a more thorough explanation can be found here: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/security/chromeos_security_whitepaper.md#going-beyond-the-browser https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sec...
- cmatthias 4y ago
  What if the attacker is the one who built and shipped the OS to begin with? Everything you say is true, but it doesn't matter as long as user data (history, location, etc) is being shipped off to Google. Or, put another way: your threat model is a nefarious hacker or three-letter-agency who might secretly modify your hardware/software to get your data. Mine is surveillance capitalism. ChromeOS is secure under your threat model, but is _built by the attacker_ under mine. Both of these threat models are important to consider, but one is much more relevant to a larger portion of the population than the other.
  - sulam 4y ago
    Relevant from your POV. A very large part of the planet clearly doesn't care.
    - cmatthias 4y ago
      I said it was more relevant than nefarious hackers or government agencies, not relevant in some subjective general sense. So whether or not they care is irrelevant to my point.

javawizard 4y ago

(Disclaimer: I also work at Google but not directly on ChromeOS.) Exactly. I would never let my (non-tech savvy) grandparents near a Linux machine without supervision, but I wouldn't hesitate to let them near a Chromebook in guest mode. Linux is quite secure in the hands of an experienced user. ChromeOS is secure in the hands of anyone who's not state sponsored attacker-adjacent.

quicklime 4y ago
It's not quite the same as "guest mode" on ChromeOS, but I make user accounts (no sudo) for non-technical family members and let them use my machines unsupervised. What are you worried about here? Should I be worried?
- kweingar 4y ago
  It depends on how much you trust your family members and whether you worry about non-root malware. Looking at my Linux machine, I notice that the default permission for home directories is 755. If I don’t think to tweak that, then I’m potentially exposing a lot of sensitive data to other users (and potentially the programs they run). I’m a proficient Linux user but not an expert, and I’m racking my brains to think of what else might be exposed to other users on my machine.
  - bravetraveler 4y ago
    I'm similarly racking my brain, and I came to the same finding. 755 permissions on the home directory lets others see what you have, which isn't great. The good and bad news is, permissions on the files matter too. SSH (private) keys for example categorically won't work outside of 600 permissions, meaning nobody else can read your private key - without escalating privileges Now, if you go defining auth secrets in your shell profile (which is world-readable by default), probably something to reconsider. Restricting umask is a good protection for this, for what it's worth. You can make it so that newly created files/directories are not accessible to the world
  - kelnos 4y ago

cmatthias 4y ago

Would you be at all concerned about the security and privacy of your guest user’s data, given your employer’s propensity for slurping up and storing whatever user data they can get their hands on? What if your guest user was searching for terms related to abortion in a US state where that procedure is (or will shortly be) illegal? What if they’re doing that and you happen to be physically near a provider of abortions?[1] Security does not only mean security of your own data stored on the device. A device made by Google will never be secure. [1] https://www.politico.com/news/2022/07/18/google-data-states-track-abortions-00045906 https://www.politico.com/news/2022/07/18/google-data-states-...

kweingar 4y ago
The host operating system does not give me more or less confidence in the security of a guest user’s web browsing data.
- cmatthias 4y ago
  Then you are either uninformed or willfully ignorant of 1) how operating systems and browsers work and 2) your employer's past actions relating to collecting and storing user data.
  - kweingar 4y ago
    I am uninformed as to how running a Google search as a guest user on ChromeOS has different privacy implications that running that same search using another operating system. Sure, if I carried around a privacy-centric Linux box and told my guest to use Tor browser, I could see how that could change the privacy picture. But that isn’t exactly an apples-to-apples comparison. If you believe that having the guest user run their search on a typical Linux, Windows, or macOS machine would be better for their privacy, I would be interested to hear how. Also, if they’re running the search in guest mode and they don’t log into a Google account, nobody can know who’s making the search. It’s not like they’re looking through the webcam or something.
    - 4y ago