4 ms·
Can we settle for containers instead? For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility? I understand that us
by ihsw 11y ago
Can we settle for containers instead?
For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility?
I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/folders and dragging them out of the browsers "Download" folder and onto the host's file system, disallowing saving files outside of that folder, and so forth) but it doesn't seem that bad.
What do most users do with a browser other than open the thing, browse websites, and download files for later?
- tptacek 11y agoNo. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience. (I hate VMs so much I just use two computers).
- thematt 11y agoWhy do you hate VM's so much? Usability? Or is there some technical reason?
- tptacek 11y agoJust slowness and usability. Also: as a defense, it's imperfect.
- MichaelGG 11y agoBecause VMware has essentially abandoned their client virtualization software? (Workstation 11 is a paid minor bug fix.) While it's way better than VirtualBox, it's still annoying. Stuff like USB devices will randomly not work. You need more system resources, which heats up the machine, making it hot to the touch. Oh and it crashes at times, too. With Windows-on-Windows setup, I was having daily crashes. VMware doesn't seem to care and offers no support with the product (gotta buy a company support plan). They even had a kb article to the effect of "Known issue: Workstation crashes when you run Office 2007". It's usable, just a bit annoying. I feel little option but to run Windows as a host OS in order to get best driver/video/battery support, so VMware is essentially mandatory. It's also a huge attack surface.
- S4M 11y agoHow about using two browsers? one of emails or banking and another one for regular browsing?
- jcrawfordor 11y agoMost of the banking-information-malware I take a look at hooks multiple browsers from the OS. So the browsers would need to be isolated in a better way than just being different browsers. Using an uncommon browser for something like banking (Opera or Vivaldi or something) would be a pretty good solution because no one would have bothered to develop the hooks for them, unless the malware is keylogging, which is not uncommon but less popular now than the smarter solution of watching browser form submits on known bank websites.
- atsaloli 11y agoIllumos zones are as lightweight as containers, can run Linux, and provide full isolation of the guest system. www.illumos.org
- JupiterMoon 11y agoIt's very easy (trivial even?) to browse in e.g. Virtual Box these days - why do the less secure thing?
- recursive 11y agoAnything that takes more than a dozen steps is not trivial.
- JupiterMoon 11y agoIf your using a Linux distro already you have to: 1. install virtual box from package manager 2. download .iso of some distro 3. install 4. update virtual machine 5. browse Of these someone who's installed their own OS has 2 slightly novel steps. So yeah trivial is maybe the wrong words but still easy.
- recursive 11y ago> If your using a Linux distro Most people aren't. I think most people haven't installed on OS at all for that matter.
- JupiterMoon 11y agoFair play. I'm around so many people that have that I forget that most haven't.
- Eiriksmal 11y agoYou forgot step 1.5: spend forever signing the VM kernel modules so they can be started under secure boot. Such pain. Fortunately, once the signature's in the UEFI, upgrading from Fedora 20 to 22 just necessitates resigning the new VirtualBox module without the UEFI steps. http://gorka.eguileor.com/vbox-vmware-in-secureboot-linux/ http://gorka.eguileor.com/vbox-vmware-in-secureboot-linux/
- deleted 11y ago[deleted]
- zorked 11y agoIsn't the Chrome sandbox a better assurance than Chrome-under-Docker? Except for the obscurity angle of course (nobody writes exploits against Chrome-under-Docker). To be fair, VMs are also mostly about the obscurity angle too, and if you do all your browing in a VM the cookies alone will make the attacker sufficiently happy that they will probably not care. People don't hack because they want root on the bare-metal OS, people hack because they want to steal data. If it's in a VM or container, then getting there is enough.
- georgerobinson 11y ago> Isn't the Chrome sandbox a better assurance than Chrome-under-Docker? Sorry, are you referring to Native Client or Chrome's site isolation?
- elorant 11y agoWhat do most users do with a browser other than open the thing, browse websites, and download files for later? The download part is the scary one. An average user can’t make the distinction between an OS message and a malware disguising as the former. Thus they download shit that wrecks havoc on their PCs. Besides, you could be infected by a compromised Flash banner so you don't even have to download anything. And I don’t think that containers are a feasible approach for the average user. I doubt VMs are either. Our best bet would be browsers running in an isolation context simulating a VM. But that would require more RAM than the average user has available.
- Fritsdehacker 11y agoIt would actually be less secure to run your browser in a Docker container. If an attacker can break out of the container, it has root access to your system. https://zeltser.com/security-risks-and-benefits-of-docker-application/ https://zeltser.com/security-risks-and-benefits-of-docker-ap...
- emergentcypher 11y ago> Chrome in a Docker container? Please dear god no. Kill me now.
- lcswi 11y agoDocker does not provide any security.