'Extreme Security' Web Browsing

Sarah S writes "The application security researcher Jeremiah Grossman described to CSO magazine how he takes extreme measure to stay safe online. The simplest tip he uses: two separate browsers: 'One, which he calls the 'promiscuous' browser, is the one he uses for ordinary browsing. A second browser is used only for security-critical tasks such as online banking. When Grossman wants to do online banking, he closes his promiscous browser, opens the more prudish one, and does only what he has to do before closing it and going back to his insecure browser.'"

Not sure how "secure" this scheme is...

[TripMaster Monkey]

How exactly is this strategy going to protect you from a keylogger?

Re:Not sure how "secure" this scheme is...

[Kranfer]

Personally, I don't think it will. A keylogger is a keylogger... I have never seen one attached to a specific browser... usually just logs everything... How can it protect you? The fuzzy pink bunnies in your mind think that you are fooling the bad people on the internet who use myspace and livejournal from getting your data and setting up a fake "you" page only to trick your friends... Or stealing your credit card #'s and buying a nice new BMW all in your name... I could use a BMW though :/

This is silly!

[RenHoek]

The article is silly. I mean most exploits are going to have a trojan running on your machine via exploits, usually with keylogging and other nasty tricks. The only thing you can stop with two browsers is the spread of cookies or activex plugins tied to your browser. The rest are going to be active regardless and will be collecting information no matter what program you are using.

The only way to be safe is to use an up-to-date browser, (and lets say anything not-IE). And if you have Firefox, look into AdblockPlus, and NoScript. If you don't want cookies to bother you, set them to this-session-only. And lastly, Firefox has a lovely "Clear private data when closing Firefox" option if you want it.

Re:That's not extreme.

[Anonymous Coward]

>> Doesn't everyone do that?

Does everyone go deep down into paranoia taking painful and mostly useless security measures ? No.

ArticleSummary.Equals(TFA) = True

[TGhostH]

Not much content there...

Am I living under a rock because I have never heard of Cross Site Request Forgery?

Is it known by a different name?

Re:Not sure how "secure" this scheme is...

[ZombieWomble]

Well, looking at the article itself (I know, I know, heresy), the point is that there are whole classes of attacks (specifically "Cross Site Request Forgery" attacks, the focus of this article) which require significant effort on the part of websites to defend against, but which are trivially defended against by having users make a point of not accessing secure and insecure sites at the same time.

It's in no way presented as a solution to all security on the internet, but a way of addressing one specific class of problems in a simple manner with a minimum of effort. Unfortunately there's plenty of sufficiently smug people on /. who will continue to repeat this idea in this discussion without even glancing at the article.

Re:Not sure how "secure" this scheme is...

[hawkinspeter]

There are easy methods to defeat a keylogger though most of them rely on the server side. Asking for only certain characters from a password (e.g. characters 1,4,8 & 9); virtual screen keyboards (just mouseclicks are recorded); drop down lists to select characters.

This news is incomplete

[Janos421]

Well the news is not well reported. This tip aims to protect against "Cross Site Request Forgery (CSRF)--considered one of the most insidious but least appreciated threats in application security". So clearly it does not pretend to address key-logger issues

For sure, in this context, the tip is quite effective.

Re:That's not extreme.

[Explodicle]

You can have both usability AND security... "common sense" is to use a browser with both all the time.

Only as strong as the weakest link

[eli pabst]

This is akin to putting a 5 inch thick steel door on the front of your house and unlocked screen door on the back. Once the "weaker" browser is compromised, generally at the very least it's going to allow user-level execution, so an attacker could modify the settings on the "secure" browser or insert a keystroke logger.

Re:Not sure how "secure" this scheme is...

[Florian Weimer]

How exactly is this strategy going to protect you from a keylogger?

It protects against CSRF attacks (at least when done properly), which appears to be the only thing the author cares about. It seems to me that a it's just some security outlet trying to gain publicity by referring to a vulnerability that has been documented for over a decade (see RFC 2109, section 4.3.5).

Trying to Think This Through...

[SixFactor]

Interesting countermeasure against CSRFs. I can just imagine Mr. Grossman not quite referring to IE (the promiscuous one) vs. Firefox (the safe one).

Given the above and operating conditions being equal (with use of solid anti-virus and firewall measures), it seems to me that if a well-designed browser was used in the first place, then there would not be a need for a "promiscuous" browser. In fact, wouldn't the use of a "promiscuous" browser increase a user's risk when conducting, uh, questionable activities? End result (cue alarming music here): the box gets compromised, and it doesn't matter if a safe browser was used for banking, etc., something nasty now lives in the box.

Continuing the FF vs IE model, if FF was designated for promiscuous activity, then the user is arguably better protected. So that leaves us with IE as the "safe" browser? The mind reels.

I know there are alternatives (Opera, Konq, etc.), but presumably Mr. Grossman is addressing mostly Windows users.

Dumbest Thing I Have Ever Heard

[fsda]

This guy is a "Security Researcher"? Let me get this straight. You have 2 browsers, one insecure, one secure. On the insecure you do your daily stuff, on the secure you do your banking. Ok. Say your insecure browser gets compromised due to a vulnerability that is not yet patched or there is no patch for. Some of the browser vulnerabilites allow for full system control. Then what? Your whole system is now FUBAR. So there goes your "secure" browser. 15 year olds have more security sense then this guy.

confusing web security with girl-friend security

[oni]

What he's describing is not a way of keeping your computer safe, it's a way of hiding porn from your girlfriend. You use some browser that she's never heard of for all your illicit surfing. Then, she fires up your computer and starts running IE, she looks in your history and sees slashdot and CNN or whatever and doesn't think you're a pervert (which you are).

It's also a good idea to have "honeypot porn" which is basically, a few very innocuous sites that you vist in IE that you intentionally want her to find - because once she starts looking, she's going to keep looking until she finds something. Best to give her something to find. Let her think you go to maxim.com or something.

Re:thats annoying...

[FredFredrickson]

I use IE as my 'promiscuous' browser and Firefox as my safe browser - makes sense to me. But of course, this is not the only means I have of protecting myself but it helps in one important way... It reminds me that I should be careful.

That makes as much sense as only wearing the bullet proof vest when you're doing non-dangerous activities.

If anything, I'd do it the other way around. Promiscuous browsing on IE will certainly get you infected (ever open a pron site with IE? I haven't in years, and I don't plan to start now- even if those exploits have been fixed). I explorer is the only browser I can remember that would just let a virus download and install itself while you battled 80 popups. I understand Iexplorer7 is slightly better, but come on- that's what people are targeting, new exploits will come up.

I do things exactly opposite. I use opera for all my browsing, and nothing gets through. Then I load up internet explorer for my online banking. (my bank requires IE). I see no danger in that, because internet explorer is clean when I do it, thanks to the fact I never use it (and I clean my system regularly) with hijack this and pv and what not.

Re:Not sure how "secure" this scheme is...

[Anonymous Coward]

Agree but I would never consider a password written down near my desk at home a real credible threat. If someone is going to break into my house, they are going to take my wallet and something of value to them, not the yellow sticky on my monitor with the text "bLowmEa$$h0l3", the crimes that you see on CSI are not what happens in real life. I could probably paint my password on the side of my house and still be safer than having a keylogger installed. Which would you feel more threatened by? The specific target of that random password you have written down and physical entry or a flaw in your OS and a keylogger?

On that note though, I do not write my passwords on my monitor, I have them in a small notebook in the drawer! I would rather use completely different passwords for each site and write them down than use the same few passwords across all sites that I need a password for.

Re:Not sure how "secure" this scheme is...

[Bender0x7D1]

Unfortunately, there are also key loggers that will do screen captures as well. If the attackers find they are unable to capture your password after you type "www.mybank.com", they can activate the screen capture capability the next time you visit that site. Sure, it takes more storage, and longer to transmit to the attacker, but if you haven't discovered you have a key logger, you won't notice the image files.

Once your system has been compromised, you can't assume anything. That's why Knoppix, or any other LiveCD, is a good idea when you want the added security. Since the media is fixed, even if you get compromised, it goes away when you reboot. However, if you are using a LiveCD, don't leave your machine running for days on end, or you could get compromised. Boot up, do what you have to do, and shut down. Sure, that's a bit paranoid, but it isn't paranoia if someone is actually out to get you.

Secure Password Manager

[(rypto*]

Nothing is as secure as your own memory..

Let us understand the flaws of this guys "grand" idea:-
1 - There is no as such a absolutely secure browser, there is no stealth mode even if you are on it how are you going to log into an account?.(Every one has holes too;)
2 - Browse without "Anonymous" proxy and your IP is advertised, i.e.. your system is out in the open..(Like someone mentioned - Keyloggers,trojan.. many many others can evade)
3 - There are always SBS(Some Bloody Software) trying to open ports for pirates.
4 - In an era of high bandwidth internet where is the wait to guess what's wrong with a computer.( scan it all )

Now..

Think, why do you have brains?
Can it keep secrets?
Can you trust it?

1- Remember and Type all your passwords & user id's- its tough if you are used to someone else remembering the password for you, its proven good for your brain..
2- Accept cookies from sites you trust ( avoid inter-site tracking cookies )
3- Keep no cache memory
4- Use ssl login whenever possible. (https://mail.google.com/mail/)
5- Use a browser without susceptible addons
6- Hide your WAN IP. ( google "anonymous browsing" )
7- Try to even remember your account numbers ( After a while it dissolves )

Give it a thought.

More importantly

[spun]

How is this going to protect you from sharks with fricken' lasers on their heads? Or even ill-tempered sea bass with lasers on their heads. Oh, wait, this scheme isn't designed with sea bass in mind. Or sharks. Or keyloggers. It's designed to protect against cross site scripting.

Re:confusing web security with girl-friend securit

[Corporate Troll]

No chance in hell... I have my own account and she doesn't know the password. Unless I get caught red-handed, she won't know.

Re:built into IE since v4

[Simon]

What you have just described is totally different and doesn't in anyway address the class of attack (Cross Site Request Forgery, http://en.wikipedia.org/wiki/CSRF [wikipedia.org] ) talked about in the article. It has little to do with scripting or zones, or that one browser is IE or the other is Firefox. Is has everything to do with the fact that two *separate* browsers are used, and that web sites in the untrusted browser can't send requests to the guy's logged in banking session.

Turning off scripting doesn't guard against CSRF either BTW. I wish people would read the bloody article (and understand it!).

--
Simon

Re:Not sure how "secure" this scheme is...

[Anonymous Coward]

A list of passwords is indistinguishable from gibberish. Notice the GP didn't advocate writing down usernames or the purpose of the passwords. For added security, add in a faux characters (e.g. third and seventh characters are fake) and faux passwords to your list.

Re:confusing web security with girl-friend securit

[Zadaz]

If you're girlfriend doesn't know you're a pervert then you're doing it wrong.