Hacker News Reader

Comment by Modified3019 | Hacker News Reader

Is there some sort of way to to keep a browser profile inaccessible to anything run by the user that isn't the browser, while still having the browser itself being usable by the user?

View on HN

Yes, you can run Firefox as its own user. I wrote about this about a decade ago; https://www.openwall.com/lists/oss-security/2023/10/24/2

The gentoo wiki also has some information about this

https://wiki.gentoo.org/wiki/Simple_sandbox#larry_runs_firef...

QubesOS? I would love to know the answer, but I think it is going to be a long time before we have proper application sandboxing on Linux.

The browser is likely the biggest threat vector running on my machine, yet there are no easy ways to lock it down to just reading/writing Downloads and its own cache.

That's part of the problem, but remember your browser has all your cookies and such - the sites that keep you logged in even when you close the window (like email).

So if anything else can read the browser's data, it can get that.

AppArmor is fairly easy.

I use firejail. At least the browser cannot see arbitrary files in my home directory, like ssh or gpg keys, password manager, and everthing else. To share files between the browser and the rest ~/Downloads can be used.

Disclaimer: Critics say firejail is too complicated to be audited and adds too much attack surface of its own.

There are lots of ways to protect your system from a browser exploit via containers, another user, a vm, etc as brought up by other people responding. However protecting a browser from other applications is basically impossible unless you also sandbox everything else you are doing. Even if you run a browser in a VM some other process run as your user could just automate clicking the UI to do whatever. If you go qubes style and isolate everything from everything then it is fine.

Protecting the browser from other applications is arguably more important now than protecting applications from the browser; as the browser contains all your security information (cookies, etc) necessary to login (or be logged in) on all your important sites.

People have been hacked by malicious Minecraft mods uploading browser data to nefarious places.

Sure; take your pick: Firejail, flatpak/bubblewrap/bubblejail, docker/podman.

Run your browser on a remote machine? Using say BrowserBox: https://github.com/BrowserBox/BrowserBox

Full disclaimer: my company develops it.

You can run Firefox in a docker container. Not sure how much GPU performance you can squeeze out of it but it's doable.

You can (allow) access to GPU for cuda applications in docker containers, so I'd be surprised if it wasn't possible to get video acceleration to work normally

Reply on news.ycombinator.com