Hacker News Reader

Comment by ihsw | Hacker News Reader

Can we settle for containers instead?

For example, running Chrome in a Docker container. Why not? Drawbacks? Security risks? Feasibility?

I understand that users download things but personally I can't recall doing that in recent memory, other than things like news/tech spec PDFs for later review. Moving downloaded files out of the browser's container would involve a fair bit of ceremony (physically selecting files/folders and dragging them out of the browsers "Download" folder and onto the host's file system, disallowing saving files outside of that folder, and so forth) but it doesn't seem that bad.

What do most users do with a browser other than open the thing, browse websites, and download files for later?

View on HN

Isn't the Chrome sandbox a better assurance than Chrome-under-Docker?

Except for the obscurity angle of course (nobody writes exploits against Chrome-under-Docker).

To be fair, VMs are also mostly about the obscurity angle too, and if you do all your browing in a VM the cookies alone will make the attacker sufficiently happy that they will probably not care. People don't hack because they want root on the bare-metal OS, people hack because they want to steal data. If it's in a VM or container, then getting there is enough.

> Isn't the Chrome sandbox a better assurance than Chrome-under-Docker?

Sorry, are you referring to Native Client or Chrome's site isolation?

No. I'm barely on board with the pain/benefit of running an isolation VM. Containers provide so much less isolation than VMs, it's hard to imagine they're worth the inconvenience.

(I hate VMs so much I just use two computers).

Why do you hate VM's so much? Usability? Or is there some technical reason?

Because VMware has essentially abandoned their client virtualization software? (Workstation 11 is a paid minor bug fix.) While it's way better than VirtualBox, it's still annoying. Stuff like USB devices will randomly not work. You need more system resources, which heats up the machine, making it hot to the touch. Oh and it crashes at times, too. With Windows-on-Windows setup, I was having daily crashes. VMware doesn't seem to care and offers no support with the product (gotta buy a company support plan). They even had a kb article to the effect of "Known issue: Workstation crashes when you run Office 2007".

It's usable, just a bit annoying. I feel little option but to run Windows as a host OS in order to get best driver/video/battery support, so VMware is essentially mandatory.

It's also a huge attack surface.

Just slowness and usability. Also: as a defense, it's imperfect.

Illumos zones are as lightweight as containers, can run Linux, and provide full isolation of the guest system. www.illumos.org

How about using two browsers? one of emails or banking and another one for regular browsing?

Most of the banking-information-malware I take a look at hooks multiple browsers from the OS. So the browsers would need to be isolated in a better way than just being different browsers.

Using an uncommon browser for something like banking (Opera or Vivaldi or something) would be a pretty good solution because no one would have bothered to develop the hooks for them, unless the malware is keylogging, which is not uncommon but less popular now than the smarter solution of watching browser form submits on known bank websites.

It would actually be less secure to run your browser in a Docker container. If an attacker can break out of the container, it has root access to your system.

https://zeltser.com/security-risks-and-benefits-of-docker-ap...

What do most users do with a browser other than open the thing, browse websites, and download files for later?

The download part is the scary one. An average user can’t make the distinction between an OS message and a malware disguising as the former. Thus they download shit that wrecks havoc on their PCs. Besides, you could be infected by a compromised Flash banner so you don't even have to download anything.

And I don’t think that containers are a feasible approach for the average user. I doubt VMs are either. Our best bet would be browsers running in an isolation context simulating a VM. But that would require more RAM than the average user has available.

> Chrome in a Docker container?

Please dear god no. Kill me now.

Docker does not provide any security.

It's very easy (trivial even?) to browse in e.g. Virtual Box these days - why do the less secure thing?

Anything that takes more than a dozen steps is not trivial.

If your using a Linux distro already you have to: 1. install virtual box from package manager 2. download .iso of some distro 3. install 4. update virtual machine 5. browse

Of these someone who's installed their own OS has 2 slightly novel steps. So yeah trivial is maybe the wrong words but still easy.

You forgot step 1.5: spend forever signing the VM kernel modules so they can be started under secure boot. Such pain. Fortunately, once the signature's in the UEFI, upgrading from Fedora 20 to 22 just necessitates resigning the new VirtualBox module without the UEFI steps.

http://gorka.eguileor.com/vbox-vmware-in-secureboot-linux/

> If your using a Linux distro

Most people aren't. I think most people haven't installed on OS at all for that matter.

Fair play. I'm around so many people that have that I forget that most haven't.

Reply on news.ycombinator.com