Comment by miles | Hacker News Reader

Comment by miles | Hacker News Reader

Thanks to the author for compiling and sharing this guide.

Two of the recommendations have the potential to make your Mac less secure:

1. > …install an ad blocker (I recommend uBlock Origin)

While uBlock Origin has a great track record, it requires these permissions:

* Access your data for all websites

* Read and modify privacy settings

* Access browser tabs

* Access browser activity during navigation

That is a lot of exposure, especially if a bad actor managed to take over the extension, e.g.,

In August 2017, the very popular and widely recommended Web Developer extension for Chrome was hijacked. The developer fell for a phishing attack, and the attacker uploaded a new version of the extension that inserted more advertisements into web pages. Over a million people who trusted the developer of this popular extension ended up getting the infected extension. As this is an extension for web developers, the attack could have been a lot worse—it doesn’t appear that the infected extension functioned as a keylogger, for example. https://www.howtogeek.com/188346/why-browser-extensions-can-...

2. > Consider tunneling your traffic through a VPN when connected to untrusted networks (I recommend rolling your own VPN server, or else I really like Mullvad, see ThatOnePrivacyGuy’s VPN comparison)

Again, Mullvad appears to be one of the best VPN services, but connecting to third party VPNs creates new risks and may not provide the security you expected:

Don't use VPN services. https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://news.ycombinator.com/item?id=16371030

Those permissions are necessary for any blocker to perform its function. And while the threat models for blockers and vpns are different, I agree that I would trust a local blocker [threat: extension hijack via auto-update; mitigation: very public source and update policy] much more than I would trust any third party vpn [threat: their 'no logging' policy is insufficient or they don't honor it; mitigation: 'we promise, mmkay?']

A self-hosted vpn would be better, but has its own problems [threats: you're uniquely identifiable by your vpn ip, you don't update fast enough to avoid security breaches, you don't configure it correctly and expose yourself to additional security breaches]. Given the difficulty of hosting and managing your own vpn infrastructure I couldn't recommend it for almost anyone.

> Those permissions are necessary for any blocker to perform its function.

Not blockers for Safari like Wipr that use Content Blocking Extensions: https://giorgiocalderolla.com/wipr.html

Content Blocking Extensions are pretty neat from a privacy perspective, but they're quite limited in functionality since they're basically glorified block lists (why you'd pay $2 for a list that's freely published is another question) and it requires support from the platform. uBlock supports a lot of features that CBE apps can't.

Especially when you can block many things on a local router.

uBlock origin has a lot of features beyond being a simple ad domain blacklist. You can remove elements from websites at wish. It can spoof information about which fonts you have installed to websites, block WebRTC and more. A pure ad blocker with a smaller feature scope will require fewer permissions. While I have not read the source code my self I have a hard time believing that uBlock origin is not limited to the lowest amount possible of required permissions to do the job it does.

Thanks for your feedback!

I agree with your points and I updated the post so.

Reply on news.ycombinator.com