just a random mind dump

Recently, I read this interview with security researcher Joanna Rutkowska on Tom’s Hardware Guide. The interview is hardcore stuff, but it is interesting to read. In the interview she  talks about her personal security measures regarding internet browsing. Joanna uses three different browsers, each in their own virtual machine. An “insecure” browser for everyday surfing, a browser used for shopping on the internet, and a very secure one that is only used for online banking.

What I particularly like about the idea is that you can roll back the “surfing”-VM to a known good snapshot once in a while, so that you’ll know it is not infected.

I think this idea is rather compelling, but using three different virtual machines is just too much overhead for my old computer at home. So I use the poor men’s solution for now:

Using different Firefox profiles.

To create a new firefox profile that you will only use for internet banking:

• start the Firefox profile manager:

  $ firefox -ProfileManager -no-remote

• create a new profile (lets call it “secure”), and start it.
• go to https://addons.mozilla.org/en-US/firefox/ and install the noscript extension for Firefox. You can also install the CookieSafe extension, it will make things a little bit easier.
• open Firefox Preferences (Edit -> Preferences on Unix, Tools->Preferences on some other Systems), and disable Java and Cookies.
• clear your private data and restart Firefox
• enter the full URL you use for homebanking in the URL-Bar, make it your homepage (Preferences -> Main) if you want.
• allow Javascript for this page using the NoScript – Icon in the Control-Bar
• allow Cookies for this page using CookieSafe or add an exception manually if you know how to do it and don’t want to install that extension.

Use this profile when, and only when, you want to do online-banking, and your default profile for all the rest. To make that easier, add an alias to your shell’s initialization file, e.g. ~/.bashrc if you use bash:

alias banking = "firefox -no-remote -P secure"

The “-no-remote” enables you to use both profiles at the same time. If all your firefoxes start with the banking profile, start firefox with the “-ProfileManager” switch and select your default profile.

You get the idea. I’ll create another profile with cookies and javascript turned off by default and only enabled on sites that I trust. And one that has all the bells and whistles of the internet enabled, but which is configured to clear private data every time it exits.

While using different profiles is not as secure as using different virtual machines, it should save you from most attempts of cross-site-scripting/cross-site-request-forgery.

Of course this is just a small addition to the more important security measures:

• Use your brain.
• Keep your software up to date.
• Use a privileged account (root/Administrator) only if you really need to. Seems like Redmond has finally learned that lesson, too.