Hacker News Reader

Comment by ttctciyf | Hacker News Reader

> enable anti-malware if your OS has it . . . Would be interested in hearing other things

Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious.

For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features".

An additional step I take is to use several browser profiles for different purposes (mail, banking, shopping, default, to name four) so that Firefox always asks me to pick a profile on startup. As well as reducing the possibility of XSS, this lets me relax the settings for some profiles where I restrict myself to a small number of trusted sites. (This may well be overkill!)

0: uBlock Origin, that is, as per instructive commment below[1]

1: https://news.ycombinator.com/item?id=34389942

View on HN

Firefox multi-account containers can be a more convenient way to isolate things, especially now that the container can be limited to only the allowed sites.

I also made an app and extensions to help me use multiple browsers, one per site. (Browsr Router)

Regards the containers, I started my profile compartmentalization practice before they arrived, so I never explored them. But I'm curious as to whether each container comes with a complete set of browser permissions, like profiles do, which would enable you (for example) to have a location-enabled container specifically for google maps (in reference to[0]) while disabling it on the container used for search, as you could quite easily do with profile compartmentalization? (Which, tbf, is a privacy rather than a security concern.)

0: https://www.simpleanalytics.com/en/blog/google-changed-googl...

Add-ons cross over container boundaries, so I suspect other browser permissions do too.

You're solution is more bullet proof. For similar reasons I am hoping to add better profile support to Browser Routr.

>Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious.

What I am looking for is an easy way to run something like a LiveCD OS in a VM for browsing. The problem is that I have never found a decent LiveCD that has Firefox with all of the mandatory extensions (uBlock Origin, etc...). I guess I could customize my own LiveCD, but last I looked into it, doing so seemed complex and too time consuming to figure out.

Posting this in the hopes of being steered towards a simple solution or to inspire someone to create one.

Windows AppGuard is close to this, although it’s a hyper-v silo not a full VM. Edge can open links in AppGuard (which is what this technology is called) right from the context menu, super convenient.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-...

That sounds interesting and I like that Edge is one of the few browsers that has vertical tabs built in. The thing is that I don't trust MS and assume that they are thieving my data in any way they can...

MS AppGuard is a clone of Bromium, now branded as "SureClick" for Chromium and bundled with HP business laptops/PCs, with a security co-processor ("SureStart") monitoring firmware integrity.

> I guess I could customize my own LiveCD, but last I looked into it, doing so seemed complex and too time consuming to figure out.

Here's a 5m solution whose starting point might be acceptable:

- install Nix

- Follow first two steps at https://nixos.wiki/wiki/Creating_a_NixOS_live_CD to generate iso

That does look simple! Are the steps:

1. Install Nix in a VM or on a clean HD

2. Customize Firefox to my liking

3. follow the two steps you highlight

4. Load my created iso in a VM

Right?

> Install Nix in a VM or on a clean HD

You should be safe to avoid this unless your threat model includes a trusting trust type exploit on Nix generating the ISO.

Also, just realized it'll be a little more complex because you'll want to use home-manager to install Firefox plugins and do about:config configuration.

Here are some examples of that in various contexts:

https://github.com/search?q=language%3Anix+programs.firefox+...

I’ve no doubt you are referring to uBlock Origin but it’s real important to label it as such so the unaware don’t install uBlock.

Thanks, yes, updated.

>> enabling protections in the browser is becoming mandatory

> or me this amounts to enabling NoScript and uBlock

Hard to see how installing third-party extensions that can view and change data for every site makes the browser more protected.

Just little a third party security guard can't make a building more secure. /s

It's about who/what you trust.

With respect the question is about the machine being compromised, I'm not sure how XSS, phishing, etc. attacks are relevant.

Reply on news.ycombinator.com