Operating Systems Need Pervasive Sandboxes
Our OSs should be doing more to protect us. We should be applying sandbox's across the board.
Yes, it requires us to think a differently about how we construct apps, but there's very little reason my "web browser" needs full access to my computer. In fact, there is zero reason why my banking and general browsing browser sessions should be running in separate sandboxes. They can be the same underlying binaries, but they should be running as separate processes in kernel enforced sandboxes with some OS provided UI sugar to enable to the user to differentiate.
Apps shouldn't be viewed as single programs, but as the collection of programs needed to do a job. your web browser app is firefox, chrome,... + whatever needs to run in its same space (i.e. plugins). You banking browser app might be the same underlying firefox, chrome... but without any of the plugins.
Of course, web browser's also have external helpers for downloaded content (office apps, media viewers...). All one needs is the ability for a program in one sandbox to launch programs in a separate sandbox.
Now, this is a problem, as they can infect that other sandbox (i.e. don't want a malicious PDF forever infecting my PDF viewing sandbox). But here we can have ephemeral sandboxes. Every time firefox hands off a pdf to a viewer, the OS creates a new sandbox instance that is thrown away once it's finished. Even if you do view a malicious file, it's changes it would be thrown away once you stop viewing it
Of course the big elephant in the room is depending on the kernel providing the proper enforcement, the obvious direction an attacker will take is to try an attack the kernel itself from within the sandbox. However, most of these compromises are user level compromises and there's minimal reason our OS's should be allowing them to happen.
thoughts?