Comment by Justsignedup | Hacker News Reader

Comment by Justsignedup | Hacker News Reader

Parent Full thread

Hmmm... Well... there are ways:

a) disable flash

b) disable java

c) disable any plugins really.

d) use chrome (at least)

e) do not allow downloading of any file. Instead use chrome's plugin to open any word/etc files in google docs.

f) Use a chromebook. Chromebooks can't really execute programs like windows machines can, so it's fairly safe. And worst case is you expose a sandbox machine with no private data other than caches, that can be set to be cleared on sleep or whatever. Bonus security points:

- if a chromebook is hijacked, it will only be hijacked until a reboot during which time the chromebook does a sanity check ensuring the OS is exactly intact. If it is not it just reinstalls the OS from ROM. Basically no long-term compromised machines.

- The only time chrome's sandbox was ever completely bypassed allowing arbitrary code execution was using a combination of multiple chrome exploits (now closed) and a windows data execution prevention bug. That can't happen on linux (and the chrome team works to further solidify that sandbox). Pretty much almost impossible. And if it is quickly patched and vuala.

g) browse in private browsing mode only

h) When visiting links (like facebook) manually type in the url to ensure nothing is spoofed.

I think you will be fairly safe. However... I doubt most people will go that far.

As sltkr said:

So to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol?

Also, I 'd recommend using noscript, with no plugins. Don't bother opening word files, get them to send it to you in plain text. Or run around with usb drives (no one ever said it would be easy).

USB drives aren't a solution either. How do you think Stuxnet got started? http://en.wikipedia.org/wiki/Stuxnet#Windows_infection

You're still not necessarily safe here from spoofing.

If an attacker can gain access to your network (splicing a network cable somewhere, long term hacks against wifi keys, etc) then they can run DNS or arp poisoning, and redirect all of your traffic through a transparent proxy that can strip off HTTPS and log all cookies and form submission.

Many people will then type in 'www.facebook.com' into the address bar, and will see facebook as normal (minus the padlock, which most people wouldn't notice is missing).

So: don't just type in 'www.facebook.com' ALWAYS type in 'https://www.facebook.com manually, or make a habbit of checking the padlock on every page view (perhaps there is a chrome addon for this?)

EDIT: and if you're being spoofed by a government or syndicate who has the ability to sign global certificates, then there is probably not much you can do.

> c) disable any plugins really.

embarrasing to admit, but I've always wanted to believe one could at least trust plugins like Adblock Plus or Ghostery to protect ones mind and privacy a little.. now, reading Hacker News almost every day, I'm getting paranoid. is it a vulnerability to even use them?

First of all, in Firefox (and I believe in Chrome too) there is a distinction between "addons" (such as adblock plus) and "plugins" (such as flash). The main difference being that plugins are DLLs containing native code, and thus have all the privileges the browser has. In comparison, addons are mostly JavaScript, and run inside the browser with somewhat limited access to the rest of the system.

Thank you for pointing it out and for a well-written explanation. Took a quick look and Chromium seems to call them all 'extensions'.

In Chrome they're different - chrome://plugins/ vs chrome://extensions/

In Firefox extensions have the same access to the rest of the system as Firefox itself including full file system access.

Addons is more generic term, it includes extensions, plugins and themes.

The more people you trust, the more susceptible you are to having that trust broken.

Let's say you trust Chrome, you can't trust AdBlock just because you trust Chrome. The install on the Chrome store could get compromised, somehow.

In this specific case though, you also have to weigh the risk of an attack being delivered from an ad. What's more likely? One of the thousands of ads you view a day launches an attack, or installing a Chrome extension does? Which would be more damaging?

Security is not an exact science. It's all about weighing options and making informed decisions.

e) do not allow downloading of any file. Instead use chrome's plugin to open any word/etc files in google docs.

I'm interested to know how google's cloud is going to implement my updated video card drivers.

Reply on news.ycombinator.com