4 ms·

> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like

> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additional step I take is to use several browser profiles for different purposes (mail, banking, shopping, default, to name four) so that Firefox always asks me to pick a profile on startup. As well as reducing the possibility of XSS, this lets me relax the settings for some profiles where I restrict myself to a small number of trusted sites. (This may well be overkill!) 0: uBlock Origin, that is, as per instructive commment below[1] 1: https://news.ycombinator.com/item?id=34389942 https://news.ycombinator.com/item?id=34389942

paulryanrogers 4y ago
Firefox multi-account containers can be a more convenient way to isolate things, especially now that the container can be limited to only the allowed sites. I also made an app and extensions to help me use multiple browsers, one per site. (Browsr Router)
- ttctciyf 4y ago
  Regards the containers, I started my profile compartmentalization practice before they arrived, so I never explored them. But I'm curious as to whether each container comes with a complete set of browser permissions, like profiles do, which would enable you (for example) to have a location-enabled container specifically for google maps (in reference to[0]) while disabling it on the container used for search, as you could quite easily do with profile compartmentalization? (Which, tbf, is a privacy rather than a security concern.) 0: https://www.simpleanalytics.com/en/blog/google-changed-google-maps-url-your-location-data-is-no-longer-safe https://www.simpleanalytics.com/en/blog/google-changed-googl...
  - paulryanrogers 4y ago
    Add-ons cross over container boundaries, so I suspect other browser permissions do too. You're solution is more bullet proof. For similar reasons I am hoping to add better profile support to Browser Routr.
pixxel 4y ago
I’ve no doubt you are referring to uBlock Origin but it’s real important to label it as such so the unaware don’t install uBlock.
- ttctciyf 4y ago
  Thanks, yes, updated.
- panarky 4y ago
  >> enabling protections in the browser is becoming mandatory > or me this amounts to enabling NoScript and uBlock Hard to see how installing third-party extensions that can view and change data for every site makes the browser more protected.
  - pbhjpbhj 4y ago
    Just little a third party security guard can't make a building more secure. /s It's about who/what you trust.
wintermutestwin 4y ago
>Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. What I am looking for is an easy way to run something like a LiveCD OS in a VM for browsing. The problem is that I have never found a decent LiveCD that has Firefox with all of the mandatory extensions (uBlock Origin, etc...). I guess I could customize my own LiveCD, but last I looked into it, doing so seemed complex and too time consuming to figure out. Posting this in the hopes of being steered towards a simple solution or to inspire someone to create one.
- Godel_unicode 4y ago
  Windows AppGuard is close to this, although it’s a hyper-v silo not a full VM. Edge can open links in AppGuard (which is what this technology is called) right from the context menu, super convenient. https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-defender-application-guard https://learn.microsoft.com/en-us/deployedge/microsoft-edge-...
  - wintermutestwin 4y ago
    That sounds interesting and I like that Edge is one of the few browsers that has vertical tabs built in. The thing is that I don't trust MS and assume that they are thieving my data in any way they can...
    - transpute 4y ago
      MS AppGuard is a clone of Bromium, now branded as "SureClick" for Chromium and bundled with HP business laptops/PCs, with a security co-processor ("SureStart") monitoring firmware integrity.
- ParetoOptimal 4y ago
  > I guess I could customize my own LiveCD, but last I looked into it, doing so seemed complex and too time consuming to figure out. Here's a 5m solution whose starting point might be acceptable: - install Nix - Follow first two steps at https://nixos.wiki/wiki/Creating_a_NixOS_live_CD https://nixos.wiki/wiki/Creating_a_NixOS_live_CD to generate iso
soheil 4y ago
With respect the question is about the machine being compromised, I'm not sure how XSS, phishing, etc. attacks are relevant.

paulryanrogers 4y ago

Firefox multi-account containers can be a more convenient way to isolate things, especially now that the container can be limited to only the allowed sites. I also made an app and extensions to help me use multiple browsers, one per site. (Browsr Router)

ttctciyf 4y ago
Regards the containers, I started my profile compartmentalization practice before they arrived, so I never explored them. But I'm curious as to whether each container comes with a complete set of browser permissions, like profiles do, which would enable you (for example) to have a location-enabled container specifically for google maps (in reference to[0]) while disabling it on the container used for search, as you could quite easily do with profile compartmentalization? (Which, tbf, is a privacy rather than a security concern.) 0: https://www.simpleanalytics.com/en/blog/google-changed-google-maps-url-your-location-data-is-no-longer-safe https://www.simpleanalytics.com/en/blog/google-changed-googl...
- paulryanrogers 4y ago
  Add-ons cross over container boundaries, so I suspect other browser permissions do too. You're solution is more bullet proof. For similar reasons I am hoping to add better profile support to Browser Routr.

pixxel 4y ago

I’ve no doubt you are referring to uBlock Origin but it’s real important to label it as such so the unaware don’t install uBlock.

ttctciyf 4y ago
Thanks, yes, updated.
panarky 4y ago
>> enabling protections in the browser is becoming mandatory > or me this amounts to enabling NoScript and uBlock Hard to see how installing third-party extensions that can view and change data for every site makes the browser more protected.
- pbhjpbhj 4y ago
  Just little a third party security guard can't make a building more secure. /s It's about who/what you trust.

wintermutestwin 4y ago

>Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. What I am looking for is an easy way to run something like a LiveCD OS in a VM for browsing. The problem is that I have never found a decent LiveCD that has Firefox with all of the mandatory extensions (uBlock Origin, etc...). I guess I could customize my own LiveCD, but last I looked into it, doing so seemed complex and too time consuming to figure out. Posting this in the hopes of being steered towards a simple solution or to inspire someone to create one.

Godel_unicode 4y ago
Windows AppGuard is close to this, although it’s a hyper-v silo not a full VM. Edge can open links in AppGuard (which is what this technology is called) right from the context menu, super convenient. https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-defender-application-guard https://learn.microsoft.com/en-us/deployedge/microsoft-edge-...
- wintermutestwin 4y ago
  That sounds interesting and I like that Edge is one of the few browsers that has vertical tabs built in. The thing is that I don't trust MS and assume that they are thieving my data in any way they can...
  - transpute 4y ago
    MS AppGuard is a clone of Bromium, now branded as "SureClick" for Chromium and bundled with HP business laptops/PCs, with a security co-processor ("SureStart") monitoring firmware integrity.
ParetoOptimal 4y ago
> I guess I could customize my own LiveCD, but last I looked into it, doing so seemed complex and too time consuming to figure out. Here's a 5m solution whose starting point might be acceptable: - install Nix - Follow first two steps at https://nixos.wiki/wiki/Creating_a_NixOS_live_CD https://nixos.wiki/wiki/Creating_a_NixOS_live_CD to generate iso

soheil 4y ago

With respect the question is about the machine being compromised, I'm not sure how XSS, phishing, etc. attacks are relevant.