The Post Ninja

  • 0 Posts
  • 333 Comments
Joined 2 years ago
cake
Cake day: July 8th, 2023

help-circle



  • Browser fingerprinting takes measurement of things the browser exposes. If a browser exposes installed extensions, this can be used to corelate information. If awebsite checks if the browser loaded something or not, that also can be used to corelate.

    Example, you (ip address xxx.xxx.xxx.xxx) visited this website (trackingsite.xyz), with a screen resolution of 1920x1080, using a (Mozilla/firefox) browser. The three trigger pixels did not load, meaning you’re using an adblocker, and the remote font loaded from localhost, not google. Your canvas, microphone, and camera are all blocked. Your browser also responded to an api ping for (useful extension). Interesting. This same configuration was also on (othertrackingsite.xyz) and (definitelyalegalsite.xyz), both of which a browser with the same info navigated to for at least 5 minutes, so we know it wasn’t a mistype. This same browser configuration was seen regularly browsing these sites on [days of the week] at [time of day], indicating a regular habit.

    We know who you are and where you have gone.





  • Blaster M@lemmy.worldtoLinux@lemmy.worldWhy No Hypervisor-Based Security?
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    2 days ago

    Incorrect. The difference is not that there’s a server edition or desktop edition (which for many linux distros, there very much are server and desktop editions, even if the only difference is which packages are installed by default), but that when you properly setup a server with internet-exposed services, you usually are smart enough, have gone to school for this, learned from experience, or all of the above, how to secure a linux system for server use, and should have a configuration setup that would be inconvenient at best for a desktop, but is more secure for the purpose of a server. In addition, when running a server, you stick to what you need, you don’t arbitrarily download stuff onto a server, as that could break your live service(s) if something goes wrong.

    The average desktop user does not have any of that experience or knowledge to lock down their system like ft knox, nor do they have the willpower to resist clicking on / downloading and running what they shouldn’t, so if most of everyone stopped using Windows and jumped to Linux, you would see a lot more serious issues than the occasional halfass attempt at linux malware.


  • If a browserjack malware does a complicated zero-click attack to gain root when you accidently typo a website, unfettered access to the system by root is a big problem. This is why SELinux exists. This is why browser sandboxing exists. This is why virtualization of modules and drivers and so on exists. This “security theatre” as you call it is to provide protection. Is protection guaranteed? No, but it’s the difference between locking your door at night and leaving it wide open.


  • Blaster M@lemmy.worldtoLinux@lemmy.worldWhy No Hypervisor-Based Security?
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    edit-2
    3 days ago

    Ah, yes, I do enjoy spending 6 months rebuilding my daily driven car in the garage because the air filter is integrated deep in the engine and not easily replaceable.

    The whole “I compile all my linux from source” might work if you are an IT major or have a lot of free time you can devote to maintaining your PC, but the majority of people that use a PC do not have the time, skill, attention span, or knowledge to do any more than press “Easy” and let the system have at it.


  • Blaster M@lemmy.worldtoLinux@lemmy.worldWhy No Hypervisor-Based Security?
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    2
    ·
    edit-2
    3 days ago

    This is a question I myself have wondered for a long while now. Before the Arch warriors come in to shout about how Secure Boot is evil and also useless and how everything Windows, Mac, and so on does for security is only needed because they’re insecure and not free and spyware and other angry words, I agree with your assessment.

    The problem is that while Linux is well tested in Server environments, it is still an insignificant factor on the desktop. Servers are very well locked down in a lot of cases, so if something makes its way into the system itself, many security mitigations on the way have already failed.

    Desktops are different because the user is a lot more likely to install/run/browse to stuff that is dangerous.

    Right now, the only saving grace for Linux is that malware targets Windows and Android primarily, the most commonly used operating systems. What’s the point of targeting less than 4 percent of the world when you can target 90 percent of the world?

    This will change if “The year of Linux desktop” actually happens and people start mass using Linux desktops. You can bet on more Linux malware happening.