Hacker News Reader

Comment by kweingar | Hacker News Reader

(Disclaimer: I work on ChromeOS at Google)

I would let anyone, even a total stranger, use my Chromebook in guest mode without a second thought (as long as I am reasonably sure they won’t steal it, break it, or disassemble it).

View on HN

(Disclaimer: I also work at Google but not directly on ChromeOS.)

Exactly. I would never let my (non-tech savvy) grandparents near a Linux machine without supervision, but I wouldn't hesitate to let them near a Chromebook in guest mode.

Linux is quite secure in the hands of an experienced user. ChromeOS is secure in the hands of anyone who's not state sponsored attacker-adjacent.

It's not quite the same as "guest mode" on ChromeOS, but I make user accounts (no sudo) for non-technical family members and let them use my machines unsupervised. What are you worried about here? Should I be worried?

It depends on how much you trust your family members and whether you worry about non-root malware.

Looking at my Linux machine, I notice that the default permission for home directories is 755. If I don’t think to tweak that, then I’m potentially exposing a lot of sensitive data to other users (and potentially the programs they run).

I’m a proficient Linux user but not an expert, and I’m racking my brains to think of what else might be exposed to other users on my machine.

I'm similarly racking my brain, and I came to the same finding.

755 permissions on the home directory lets others see what you have, which isn't great.

The good and bad news is, permissions on the files matter too.

SSH (private) keys for example categorically won't work outside of 600 permissions, meaning nobody else can read your private key - without escalating privileges

Now, if you go defining auth secrets in your shell profile (which is world-readable by default), probably something to reconsider.

Restricting umask is a good protection for this, for what it's worth. You can make it so that newly created files/directories are not accessible to the world

> Looking at my Linux machine, I notice that the default permission for home directories is 755.

Whoa, what? I'm running Debian, and it's 700 for me. What distro are you running? This seems like a bad choice by the distro maintainers...

> I’m racking my brains to think of what else might be exposed to other users on my machine.

Including root?

It depends what you mean by “secure”. I don't count leaking data to Google as “secure”.

What do you think your technically inept family could actually do to your Linux system?

The permission model is such that the most damage they should be able to do, is to an account you've provided to them

Or are we assuming they get sudo and unlimited time, like the typewriter thing?

I'd be more worried handing it over to a experienced person who's familiar with rd.break, assuming the filesystem isn't encrypted

I specifically give family members Linux so I don't have to go clean hundreds of toolbars and the like, as I've had to with their Windows boxen

Would you be at all concerned about the security and privacy of your guest user’s data, given your employer’s propensity for slurping up and storing whatever user data they can get their hands on? What if your guest user was searching for terms related to abortion in a US state where that procedure is (or will shortly be) illegal? What if they’re doing that and you happen to be physically near a provider of abortions?[1]

Security does not only mean security of your own data stored on the device. A device made by Google will never be secure.

[1] https://www.politico.com/news/2022/07/18/google-data-states-...

The host operating system does not give me more or less confidence in the security of a guest user’s web browsing data.

Then you are either uninformed or willfully ignorant of 1) how operating systems and browsers work and 2) your employer's past actions relating to collecting and storing user data.

I am uninformed as to how running a Google search as a guest user on ChromeOS has different privacy implications that running that same search using another operating system.

Sure, if I carried around a privacy-centric Linux box and told my guest to use Tor browser, I could see how that could change the privacy picture. But that isn’t exactly an apples-to-apples comparison.

If you believe that having the guest user run their search on a typical Linux, Windows, or macOS machine would be better for their privacy, I would be interested to hear how.

Also, if they’re running the search in guest mode and they don’t log into a Google account, nobody can know who’s making the search. It’s not like they’re looking through the webcam or something.

Your scenario is oddly specific -- I didn't say anything about a Google search, or about ensuring that the user doesn't log in. In fact, going to www.google.com in an incognito window pops up a little animated box on the right hand side encouraging me to sign in, so I'd expect there's a good chance that my guest user _would_ sign in if they visit a Google-owned site.

> If you believe that having the guest user run their search on a typical Linux, Windows, or macOS machine would be better for their privacy, I would be interested to hear how.

The main reason is that Google controls the entire environment on a ChromeOS device (kernel, userland, browser), and ChromeOS is closed source so it's not possible for me to easily know what is going on. In addition, Google makes money by collecting data about users, so there is an incentive to collect as much information as they can get away with (and they've shown repeatedly in the past that they do just that). Maybe there's a daemon running in the background shipping URL history off to some Google endpoint in the name of "telemetry", or maybe not. Or maybe it's something more innocuous-sounding like hashed or anonymized data (which could be reconstructed given Google's immense amount of data). But I don't know, and I don't think it's reasonable for anyone to implicitly trust ChromeOS at all given the business model of the company that makes it.

On most Linux distributions, nearly everything is open source and I'm free to audit what's going on. On macOS devices, the software is closed source, but the company's business model does not involve building a dossier on each and every person on the planet, so I trust them more (not fully, but more). In the past I would have said the same about Windows, but lately I'm not so sure and I tend to put them in the same bucket as Google.

edit: Also see my reply to you in a different sub-thread where I explain this in terms of threat models. If you were building a secure OS to protect high-risk individuals like journalists reporting on intelligence leaks, you would be crazy to recommend that the journalists to use an OS built for them by the NSA, MI5, or FSB. Would you feel any better about the recommendation if the government agency said "Don't worry, as long as you use guest mode and don't sign in, we won't collect any data about you"?

I guess in practice this doesn't come up often. but it's a powerful testament to your confidence in ChromeOS' security. You are implying that you don't feel the same way about a Linux user guest login. But why? What additional security measures are present in ChromeOS that are missing from popular Linux distros?

I don't doubt the features are there, I'm genuinely curious what they are.

You can harden and configure a Linux system to have many of the ChromeOS security features, but ChromeOS has all of these enabled by default:

- All user data is encrypted at the login level. A guest user cannot access any other users’ data. Whereas in Ubuntu, for example, home directories have 755 permissions.

- The Linux userspace in ChromeOS is actually running on KVM, so ChromeOS itself is insulated from user-installed malware.

- Verified boot is huge. It is theoretically impossible for a modification to system-level software to survive a reboot. An attacker would have to modify the hardware too. And even if someone stole your Chromebook and modified the hardware to run malware, your data is still encrypted.

If you are interested, a more thorough explanation can be found here: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sec...

What if the attacker is the one who built and shipped the OS to begin with? Everything you say is true, but it doesn't matter as long as user data (history, location, etc) is being shipped off to Google.

Or, put another way: your threat model is a nefarious hacker or three-letter-agency who might secretly modify your hardware/software to get your data. Mine is surveillance capitalism. ChromeOS is secure under your threat model, but is _built by the attacker_ under mine.

Both of these threat models are important to consider, but one is much more relevant to a larger portion of the population than the other.

Relevant from your POV. A very large part of the planet clearly doesn't care.

I said it was more relevant than nefarious hackers or government agencies, not relevant in some subjective general sense. So whether or not they care is irrelevant to my point.

Reply on news.ycombinator.com