Problems? See this thread at archive.org.
On a scale of 1 to 10, 10 being most paranoid borderline OCD borderline certifiable, how paranoid r u about your computer's security?
e.g. are you afraid of worms and viruses? afriad of hackers? afriad of tracking cookies? afraid of flash sites? do you turn off javascript? do you use firefox instead of IE? etc etc etc.
What measures do you take to this end in feeding to your OCD in security?
e.g. do you install antiviruses with software firewall and hide behind a router's NAT? do you install noscript on firefox? do you use bitlocker? do you spend a few hours a day searching sites on hardening your rig? do you configure group policy settings to lock ur system down? etc etc etc.
Tell us about it. Be comprehensive too so us noobs can learn the ways of the master.
______
I myself am prob on a lvl 2-3. I have free avast and thats about it. I even use IE sometimes I dont care. I also use administrator account only.
-
Great Q, I would rate myself a 10. I will start with choice of browsers, I am an IE guy and to beef up security much can be done. set security level to high, turn off the save passwords feature, use phishing filter, never turn off pop up blocker, never type in url's directly , use a search engine such as bing to verify url's . don't use trusted sites feature. Delete browsing history on exit.. I could go on.
Also do a regular full system image and frequent incremental backups. I even store my external hard drive with images off site. (in my bomb shelter)
Last article I read on tracking cookies is that they do their dirty work before you can delete them...
I also do not install java. I come from a company where I could get around almost every wall they raised so I learned from their mistakes.
Also I use a spoof email account for many sites that I am not certain are legit. -
-
Paranoid, afraid? No.
Aware, alert? Absolutely.
Despite what the general public thinks, hackers have better things to do than break into your home computer; they (poorly) write software such as keyloggers and botnet rootkits that unaware net users (read: idiots) freely download themselves, they are often disguised as other programs like keygens. Then the rootkit phones home when required, or worse, lies dormant until a master call is initiated and your computer is revealed as a zombie in a large botnet.
Sometimes hackers will set traps in free unsecure wifi zones to catch idiots who transmit personal or financial data, again easily avoided. If a hacker is specifically targeting you, you've done something to royally tick one off and you might have had it/seen it coming. They don't do random targeted attacks. It's either random, or targeted.
@josea
I do that too, it's actually really good practice. You wouldn't believe how much spam my spoof accounts get, though it's a tad embarassing that nbr points to one of them (don't get any spam from nbr though )
As far as my own awareness goes... it's up there. While I don't encrypt my HD (what's the point? if someone steals your drive the sucker is going to be decrypted or trashed no matter what, and it's probably your own fault for letting your stuff get jacked) or use crazy addons like https everywhere for my home usage, when I'm mobile or on a network that has an ounce of untrustworthiness (like a public net) I will use a customized live linux USB for pretty much anything I need to do. Though I still won't do transactions and the like at anywhere but home.
@ksd: "and 25 for NSA"
I lol'd, because they NSA really doesn't have better things to do sometimes and really does do random peekjobs in the interest of "national security". Because your grandmother's secret pie recipe is a danger to the USA. -
-
I would rate myself 10 outta 10
I do my best not to get stampped while surfing / downloading.
Using Avast, malwarebytes and Defender. (Still got some crazy stuff happening in my system.)
I go crazy when i see some friend of mine suddenly mailed me a link, be it on email or FB wall.. i open my incognito n paste it there, delete the last few character talking about some ID numbers and then hit the go
I dont EVER click the sites from google search [or somewhere else] which got even a orange warning from WOT.
I cross check any USB thumb drive with Malwarebytes and then Panda USB vaccine.
I think my case would warrant for a cyber-psychiatrist
-
Maybe a 2
I have 12 different partitions to each and every hard drive i have with each partition getting a different manufactuers AV/Firewall/Malware program and i constantly have these backed up into image drives that are then scanned with yet another AV program. The information is then reimaged on different partitions than original so the process can start anew. After my default is reloaded into partition 1 i then allow myself to access the internet with all sites blocked except wikipedia, yahoo and NBR (and settings to high in all net browsing). After 5 minutes of internet time i have it set to force log off and repeat the 12 step process again so i'm sure no one has snuck anything in while i was carelessly browsing and maybe not paying attention.
After i finish my daily browsing i have the process repeat once more than imaged into a totally clean drive and then have all "used" drives secure erased 10 times to make sure nothing is left.
See not paranoid at all
Just kidding... Basically i just install Microsoft Security Essentials and watch what i do online (i.e no funny sites, no random email attachements, etc) and have a strong password on my routers firewall. Just the basics -
-
-
-
-
-
-
So if I show you a hole in a virtual machine monitor or hypervisor then it's a valid argument, but if some days later the vendor would have fixed the hole the argument would become invalid? Isn't that a bit short-sighted?
The biggest problem with this is that the rate of zero day vulnerabilities which are found by different people during the same timeframe increases. In consequence, it gets more and more likely that there are zero day vulnerbilities that few have heard of yet but are being exploited by some malware, because the rate of people who decide to not disclose information about the vulnerability to people who do exploit it changes. Of course this is true for all software, but the problem with it is that from my experience, people sometimes just won't belive that this also applies to the concept of a virtual machine and that it is not automagically secure at all times - which is the reasoning for why it doesn't matter that the example is old. For those like you who already knew that nothing is fool proof, it's nothing new, but there are two reasons why I provided an example:
- There are various kinds of readers on this forum, and I'm trying to keep my posts understandable
- I couldn't estimate what amount of knowledge you might have about virtualization, but you statement of "Malware? Bring it! I have snapshots." made me believe that you might just have started to use virtual machines.
It seems to me that you felt offended by that, which was not my intention.
A more recent example of someone relying on a virtualization software and paying a high price for it was when the root keys for the Sony PS3 and PSP gaming consoles became compromised. And when the security system of Microsoft's Xbox360 gaming console got compromised for the first time. And these virtualization systems are VERY important to the respective enterprises. The difference between them is that when the Xbox360 got compromised for the first time, it practically had no effect on Microsoft, because they had good plans for that. They released an update that was being installed by many people because it was required for Xbox live, which Microsoft made a central experience of the Xbox360. That update burned a fuse on the processor which made downgrades impossible because the previous firmware would not have understood the "new" processor. Sony's only plan seems to be "If a feature becomes a security risk, remove it." (they removed "Other OS"). You probably know how that turned out.
So what I'm saying is: yes, right now there may not be any known vulnerabilities in whatever virtualization software it is that you're using, but if you don't have plans for worst-case scenarios and procedures that help protect you then that might change faster than you want it to. So my argument is indeed like saying "SSH isn't secure because in SSHv1 there was a buffer overflow that granted you root access", which is exactly what I wanted to make clear in the context of virtualization in order to prevent that someone believes that virtual machines are armor plated. Quite a few people who don't have much experience with vitualization solutions believe that they are.
Relying on virtual machines is not enough. For instance, the concept of a virtual machine is not taking into account the varios threats by insufficient physical security. What about access to firewire? HDDs that don't use good low-level encryption, lost laptops? Data left in spare areas of erased SSDs? Hardware keyloggers? It's not just potential access from the internet that's an attack vector, and at the same time on the other extreme, virtual machines can't do anything against attacks that mainly take place outside of the host, such as Koobface, or router DNS manipulation through XSRF.
Another question is: yes, virtual machines give you the ability to use snapshots, but do you actually make use of that feature in a way that would increase security? Do you have updating automatisms for the virtual machines which will return them to an up-to-date state after you wipe them regularly, and do you even wipe them regularly?
There are also known succesful attacks on a Harvard Architecture system through buffer overruns.
Yes, again these are just examples, but they explain the most important thing about security: that there's an endless number of things that have to be considered, of which you have to find the relevant ones. It's not a GOOD THING to say that virtual machines are "magic bullets" - people may misinterpret that if they don't have as much experience and/or knowledge about security.
PS: Am I the only one to think it's funny how everyone in here saying that he/she isn't concerned about security automatically verifies that statement by disclosing the information that he/she is not concerned about security?
-
-
-
I'm not afraid to surf the web but I am constantly alert and aware.
My AV has real-time protection shields and updates itself each and everyday.
I scan usually 5 times a week (full scans, I like to switch between full scans with Avast and Malwarebyte's)
I have Ad-Block Plus
I have Spyware Blaster
And good ol' windows firewall from Windows 7
I feel protected and safe -
-
-
Well, I suppose I am careful with my files and online security.
To login into my laptop, you would need one of my ten fingers (and no, fingerprint scanners don't work with dead, cut-off fingers ). Otherwise, it's a long, long password of all sorts of characters.
On my hard drive, I have a 8GB TrueCrypt file, protected by AES+Twofish and Whirpool hash. To generate its password (as well as all my other passwords), I used a randomly-generated 32-character password with all possible characters (or, for websites that don't accept 32 characters or special characters, whatever is the highest and most secure). My Keepass is AES protected with a long, but easy to remember password (though most people don't know much about what I like in my private life, so it's easy for me to remember a password based on something other people wouldn't know about me). Keepass-stored passwords are mostly used for secure websites, like email and online banking; for online forums, I still type in my username/password.
I use Microsoft Security Essentials for real-time virus protection, and Malwarebyte's Anti-Malware free version for more in-dept scanning.
With Firefox, I have Adblock-Plus, NoScript (I have to admit that this is annoying when you first use it, but most of my most-visited sites are white-listed), HTTPS-Everywhere, and BetterPrivacy. Sure, my internet performance is slowed down on an already slow connection (1.5Mbps DSL), but I don't game online, nor stream video, nor use torrents very often.
And, probably the most important security feature in my opinion, is that I never allow anyone other than myself to use my laptop. Nobody. Period. No ifs, ands, or buts. Another common sense idea is that I don't post personal contact information on my Facebook account (or anywhere else, for that matter), except for the required email address (one that I don't use often). No phone number, no address, and obviously no other information that I am not 100% comfortable with sharing with the rest of the internet.
Another practice I have, though not strictly a security feature, is to have multiple backups of everything information (school work, legal, photos of things dear to me, etc). Aside from my laptop's drive, I have another two laptop drives laying around that I can attach via a hard drive dock, and I have a portable hard drive and flashdrive as well, plus a Dropbox account (with my data encrypted, of course). Each solution has its own TrueCyrpt file
Paranoid? Maybe, but I feel safe that it's next to impossible for anyone in the world to harm my data or myself using technology as an attack vector (I'm still suspect to someone physically attacking me, but there's not a lot anyone could do about that). -
I assume they require all your fingers because if something were to happen to your idex (broken, burnt, cut, swollen, chopped off, etc.) you could use your other fingers to gain access to folders/logins/files, etc.
It would be really annoying to remove a bandaid from your cut finger, scan it, and then put the bandaid back on for example.
Scanning all fingers took me 5 minutes, so it's not like you'd be going out of your way to enter them all
-
How paranoid are you about security?
Discussion in 'Security and Anti-Virus Software' started by noobpad, Feb 22, 2011.
