'Extreme Security' Web Browsing 267
Sarah S writes "The application security researcher Jeremiah Grossman described to CSO magazine how he takes extreme measure to stay safe online. The simplest tip he uses: two separate browsers: 'One, which he calls the 'promiscuous' browser, is the one he uses for ordinary browsing. A second browser is used only for security-critical tasks such as online banking. When Grossman wants to do online banking, he closes his promiscous browser, opens the more prudish one, and does only what he has to do before closing it and going back to his insecure browser.'"
thats annoying... (Score:4, Interesting)
Better secure browsing (Score:4, Interesting)
Re:Not sure how "secure" this scheme is... (Score:5, Interesting)
Unless somebody really wants your data [thinkgeek.com]
That's not all that secure (Score:4, Interesting)
Or, as others have suggested, a dedicated virtual machine which can revert its state at shutdown, so you know there won't be any nasties lurking even in the sandbox.
Re:Not sure how "secure" this scheme is... (Score:3, Interesting)
Re:Not sure how "secure" this scheme is... (Score:1, Interesting)
It is safe to write down passwords. We are good at keeping bits of paper safe. That is what a wallet is for.
I do exactly the opposite. (Score:1, Interesting)
I do exactly the opposite.
I use my paranoid-secure browser when I visit random sites (like clicking on Google results), which constitutes the vast majority of my browsing.
I use my "insecure" browser to give me more functionality when I visit sites that I trust the most. (Actually, I am sometimes forced to use my "insecure" browser in this case because the site might require me to enable JavaScript (or whatever) in order to log in.)
I think it's fascinating that he does just the opposite of me, and he somehow thinks that it's "more secure".
Re:Not sure how "secure" this scheme is... (Score:5, Interesting)
And what, exactly, is wrong with this? Bruce Schneier [schneier.com] offers the following wisdom [nytimes.com]:
I write my passwords down. There's this rampant myth that you shouldn't write your passwords down. My advice is exactly the opposite. We already know how to secure small bits of paper. Write your passwords down on a small bit of paper, and put it with all of your other valuable small bits of paper: in your wallet.
Re:confusing web security with girl-friend securit (Score:4, Interesting)
Why do online banking? (Score:2, Interesting)
Why do online banking?
My bank had a poster in the lobby stating that they used "state of the art" security measures to protect their online banking customers. I reflected on the state of the art and wondered why anyone would trust their money with online banking. For me the risk / convenience just doesn't work out. My electronic banking is limited to checking balances and cleared checks by phone. I know my account number and password are transmitted in cleartext (clearbeeps), but access to the phone network is reasonably limited and the phone access system doesn't allow transfers to anywhere but my other accounts. I'm curious what benefit other people feel they get from online banking.
I'm a little troubled by the security researcher's online banking ritual. Its not that it doesn't make sense technically and help protect against a class of attacks. It just feels wrong. It feels like he is performing a ritual to reassure himself before doing his online banking, which he clearly has reservations about. He does not discuss any other measures he takes to secure his system.
Those who talk about booting off a live CD such as Knoppix sound a little more sensible to me, as the integrity of the system is pretty well ensured. This isn't an approach that scales well to the general public, though, for reasons of convenience and knowledge. It involves education about the risks, downloading and burning and ISO and sometimes fiddling with BIOS settings - not something that the bank is likely to ask users to do. A bootable read-only flash drive might simplify things, though. Maybe a security minded bank would distribute bootable read-only flash drives with built-in password-generating fob. Plug in, boot, see browser window already pointing to your bank's site with secure connection. Type in account number from a card, password from memory and number from fob. Now I want to know how you would break this system. Let the replies begin...
-Jon
Re:Not sure how "secure" this scheme is... (Score:2, Interesting)
Re:Not sure how "secure" this scheme is... (Score:3, Interesting)
Re:Not sure how "secure" this scheme is... (Score:2, Interesting)
First, print out block of random (as random as possible, anyway) characters onto a business card. Then, any time you need a new password, pick a starting point, direction, and number of characters -- this can be represented with 5 numbers. Now's where it gets tricky -- you don't want to write those numbers down, but you want to be able to remember them -- construct an invertable function, run the numbers through that function, and write the result down on the back of the business card.
Re:Not sure how "secure" this scheme is... (Score:1, Interesting)
I have a VM that is set up to not save any changes when it shuts down. So it functions just like a LiveCD except it is fully customizable. If I wanted to make changes (such as windows update) I can change the disk settings to persist, update, shut down and then change the settings back.
Doesn't help if the person is an idiot and give out his CC number to anyone that asks for it though.
Re:Not sure how "secure" this scheme is... (Score:1, Interesting)
Or the bad car analogy. I tied a tow-line from my Nova to my Porsche. What I didn't consider is that when someone steals the Nova, they get the Porsche with it. And when I drove the Nova off a cliff, the Porsche went with it.
This guy is apparently talking about a specific type of attack, Cross Site Request Forgery (CSRF). The only reason he's doing this is so that he is only authenticated to the secure site while the second browser is running. You could have the same effect in a single browser by using the "delete cookies and temp files when I close my browser" setting, and closing the browser before and after going to a secure site. Once I realized he was only protecting himself against one type of attack, it made sense, but using two different browsers seems like a really clunky way of doing it. And by clunky I mean ignorant.
Too bad comments are disabled on the article or we could explain what they failed to clarify for the reader, and what they failed to ask the random bloke they interviewed.
Re:Not sure how "secure" this scheme is... (Score:3, Interesting)
I had an incident a few years back where one of the end users I support got infected with an IE specific keylogger trojan. It quickly became apparent because the machine was using a restricted IP address which requires proxy access with a login to reach sites outside the LAN. IE started asking for a login to the proxy server even when the user was only browsing internal sites. It took some investigation to figure out what had happened but we discovered the trojan and how its activity sending keylogger data to an outside site was what was triggering the unexpected proxy login requests.
Re:Not sure how "secure" this scheme is... (Score:2, Interesting)
At best, they can only use this weird psuedo-2-factor thing where there's one thing you know, that others may try to obtain through various technological means - your password - and then another thing that they just kind of figger that nobody but you will probably know, and that those same "others" who may have obtained your password through technological means, won't be able to get (security questions, etc.).
Online banking won't be able to implement 2-factor verification until card readers, or some other method to verify that you have something in your possession become standard.
Re:Not sure how "secure" this scheme is... (Score:4, Interesting)
The screen was a fresnel lens type cover, so you had to be standing at the correct orientation to the screen to read it. People behind you any distance, or off to the side even a little, could not see the screen at all. The screen presented a numeric keypad and you had to key in your passcode.
The trick here is, the keypad was not a standard 0-9 3x3 grid. The numbers were in a 3x3 grid, but were in random places each time you used it. So anyone watching your hands to see what you pressed wasn't getting anything useful besides the length of the passcode. (which was fixed at 10 characters) There was a setting to shuffle the keys on each keypress but that was found to get on people's nerves, so you could presumably figure out if a person had a pair of letters in the code that were the same but that's not too big of a deal.
Only thing is a screen scraper combined with a keylogger (to log mouse clicks) would still own all of this.