Browsers, security and paranoia

MAAWG is coming up and lots of us are working on documents, and presentations. One of the recent discussions is what kind of security recommendations, if any, should we be making. I posted a list of things including “Don’t browse the web with a machine running Windows.”
Another participant told me he thought my recommendation to not use a windows machine to browse the web was over the top and paranoid. It may be, but drive by malware attacks are increasing. Visiting big sites may not be enough to protect you, as hackers are compromising sites and installing malware to infect visitors to those sites. Some ad networks have also been used to spread malware.
Criminals have even figured out how to install malware on a machine from email, without the recipient having to click or open attachments.
Avoiding the internet from a machine running Windows is a security recommendation I don’t expect many people to follow, but I do not think security and anti-virus software is enough to protect people from all of the exploits out there.
Of course, there are a lot of reasons that one might be forced to use a particular browser or operating system. For instance, I was on the phone with my bank just today to ask if they supported Safari. They say they do, but there are some things that just don’t work. The customer service rep said that they recommend Internet Explorer to all their users. She then suggested I switch browsers. No thanks, I’ll deal with the broken website.
Compromises are a major threat, and criminals are spending a lot of time and money on creating ways to get past current security. No longer is “not clicking on malware” enough to protect users. When a security clearinghouse is compromised and used as a vector for a targeted attack against Google, none of us are safe. When a security company is compromised, none of us are safe.
I realize my recommendation to avoid browsing the web on a Windows based machine is more wishful thinking than practical. I also know that other browsers and operating systems will be targeted if enough people move away from currently vulnerable operating systems. And I know that a simple, offhand suggestion won’t fix the problem.
As someone who’s been online long enough to see the original Green Card spam I know that online dangers evolve. But I can’t help thinking that most of us aren’t taking the current threats seriously enough.

Related Posts

Spamming ESPs

In my mailbox there is a definite uptick in spam from ESPs advertising their services.
Today’s email was from a company that has the following in their anti-spam policy:

Read More

Is any data safe?

Today another major retailer announced their customer files were compromised. This company had clearly implemented some security that kept hackers from getting too much information. Passwords were hashed and credit card numbers were kept on a separate server, which does signal that the company designed with security in mind. Nevertheless, personal information was compromised.
Is there anyway to keep information safe if it’s accessible from the internet? Some of my uber-security conscious friends would say no. I am beginning to believe them.

Read More

Court rules blogger is not a journalist

Last week a federal judge ruled a blogger, Crystal Cox, was not a journalist and not subject to first amendment protections. I haven’t been following the case very closely, but was a little concerned about the precedent and the liability for people like me who blog.
Reading some of the articles on the case, though, I’m less worried. This isn’t a blogger making some statements. Instead, Ms. Cox acted more like a stalker and harasser than a reporter. The judge even concluded that had she been granted protection as a journalist it was unlikely she could prevail as there was little factual basis for her statements.
Others have done better summaries of the case and the effect and I encourage everyone to read them.
Seattle Weekly
New York Times
Ars Technica
Forbes

I also discourage folks from applying this ruling to all bloggers. It’s not clear she was doing anything journalistic. I did find it interesting that some of her techniques to ruin the lawyer’s search results were defined as Search Engine Optimization. I’ve long thought SEO was akin to spam: say something often enough in enough places and you start to dominate the conversation. Not because you have anything useful to say, but because no one can get an idea in otherwise.

Read More