3 ms·

> I firewall off all outgoing traffic by default. At what level? Unless you're running every native binary on its own hardware, or maybe within a VM on an isol

> I firewall off all outgoing traffic by default. At what level? Unless you're running every native binary on its own hardware, or maybe within a VM on an isolated VLAN, how can you be so confident that your firewalling method is less leaky than the battle-tested sandboxing of Chromium or WebKit? Also, why not both? The most secure option might be running a web app in an isolated Chromium process, with a Chromium extension allowlisting outbound connections, and then also firewalling the Chromium process itself at the operating system level.

JohnFen 4y ago
I run exclusively Linux, and on each machine I've set up, all outbound traffic is dropped. I whitelist specific applications as needed. I do this by using rules that match --gid-owner, and change the group ownership of whitelisted applications to a special group that those rules will catch. > how can you be so confident that your firewalling method is less leaky than the battle-tested sandboxing of Chromium or WebKit? I can't be 100% certain, of course -- although that's equally true of Chromium and webkit. But I have a monitoring system that checks my firewall logs to catch anything suspicious. > The most secure option might be running a web app in an isolated Chromium process Because fingerprinting. I can't think of any way to stop fingerprinting. The best I can do (and I do) is to disallow JS from running, but that still leaves many possible signals.
- nyarlathotep_ 4y ago
  What are you using to accomplish this? iptables?
  - JohnFen 4y ago
    Yes, iptables.
- fbdab103 4y ago
  How do you know the app is not using a side channel to exfiltrate data through the normal mechanism of operation? Zoom - I expect it to require significant amount of bandwidth to operate. How am I to know that if remote call X fails it will not just route data through the video path?
- cowl 4y ago
  > Because fingerprinting. I can't think of any way to stop fingerprinting. The best I can do (and I do) is to disallow JS from running, but that still leaves many possible signals. This is even worse for native apps. webapps do fingerprinting because they don't have access to lowlevel native information. Any native App does not need to do Fingerprinting, they can just read device IDs directly, much more reliable that any method of fingerprinting.
  - JohnFen 4y ago
    > This is even worse for native apps Not if those apps can't phone home.
    - cowl 4y ago
      Unfortunetly less and less apps nowdays can work in an exclusive offline mode. There is no way to distinguish between legitimate traffic and "telemetry" trafic.

JohnFen 4y ago

I run exclusively Linux, and on each machine I've set up, all outbound traffic is dropped. I whitelist specific applications as needed. I do this by using rules that match --gid-owner, and change the group ownership of whitelisted applications to a special group that those rules will catch. > how can you be so confident that your firewalling method is less leaky than the battle-tested sandboxing of Chromium or WebKit? I can't be 100% certain, of course -- although that's equally true of Chromium and webkit. But I have a monitoring system that checks my firewall logs to catch anything suspicious. > The most secure option might be running a web app in an isolated Chromium process Because fingerprinting. I can't think of any way to stop fingerprinting. The best I can do (and I do) is to disallow JS from running, but that still leaves many possible signals.

nyarlathotep_ 4y ago
What are you using to accomplish this? iptables?
- JohnFen 4y ago
  Yes, iptables.
fbdab103 4y ago
How do you know the app is not using a side channel to exfiltrate data through the normal mechanism of operation? Zoom - I expect it to require significant amount of bandwidth to operate. How am I to know that if remote call X fails it will not just route data through the video path?
cowl 4y ago
> Because fingerprinting. I can't think of any way to stop fingerprinting. The best I can do (and I do) is to disallow JS from running, but that still leaves many possible signals. This is even worse for native apps. webapps do fingerprinting because they don't have access to lowlevel native information. Any native App does not need to do Fingerprinting, they can just read device IDs directly, much more reliable that any method of fingerprinting.
- JohnFen 4y ago
  > This is even worse for native apps Not if those apps can't phone home.
  - cowl 4y ago
    Unfortunetly less and less apps nowdays can work in an exclusive offline mode. There is no way to distinguish between legitimate traffic and "telemetry" trafic.