Most secured os+browser? - Page 1
Forum section: electronics / general

author: Rick Law
author_rank: Super Contributor
timestamp: April 25, 2017, 06:01:48 pm
content: Which do you think is the most secured os+spreadsheet+browser would you recommend for personal financial management?This will need (but not absolutely require) spreadsheet features to do evaluation. It will require web access to do actual management.

author: timgiles
author_rank: Regular Contributor
timestamp: April 25, 2017, 06:28:00 pm
content: Most secure - separate the web browsing requirement on to one laptop and a second laptop which is rarely if ever connected to the internet for the spreadsheet etc..Prehaps this is not quite the answer you are looking for. But in my experience of family members who have tried having a 'finance laptop' for keeping payment details of staff on, they have in most cases ended up being caught by a virus etc... by accidentally browsing to the wrong site etc... Unless you need to actually copy / paste from interent pages, this is pretty much your best bet.

author: Bicurico
author_rank: Super Contributor
timestamp: April 25, 2017, 06:34:31 pm
content: There are special DVD's with Live Linux and banking software. You boot from the DVD (read-only) and store your data on a USB memory.If you are paranoid, you might consider being monitored through hacked BIOS, though.Regards,Vitor

author: douardda
author_rank: Regular Contributor
timestamp: April 25, 2017, 06:34:51 pm
content: You may want to try QubeOS :https://www.qubes-os.org/David

author: james_s
author_rank: Super Contributor
timestamp: April 25, 2017, 06:35:01 pm
content: No matter what OS and browser, the biggest security risk by far is the user.Least secure browser is pretty well agreed to be Internet Explorer, with some versions being worse than others. Current versions of all the major operating systems should be reasonably secure, but again this depends greatly on user behavior and how the system is administered. Linux has a reputation of being fairly secure but that requires the person setting it up to know what they're doing. The most secure OS is probably the one that the administrator involved is most knowledgeable working with.

author: HoracioDos
author_rank: Frequent Contributor
timestamp: April 25, 2017, 06:46:11 pm
content: Quote from: douardda on April 25, 2017, 06:34:51 pmA second option could be Trusted End Node Security (TENS) designed by US Air Force and NSA approvedhttps://spi.dod.mil/lipose.htmTENS-Public is a safer, general-purpose solution for using web-based applications.

author: kripton2035
author_rank: Super Contributor
timestamp: April 25, 2017, 06:49:53 pm
content: Quote from: james_s on April 25, 2017, 06:35:01 pm+1000

author: rdl
author_rank: Super Contributor
timestamp: April 25, 2017, 07:00:52 pm
content: Quote from: Rick Law on April 25, 2017, 06:01:48 pmI don't know, but would be willing to bet that it:A. is open sourceB. is not provided by MicrosoftC. is not provided by AppleD. has nothing to do with Google whatsoever

author: Terrius
author_rank: Contributor
timestamp: April 25, 2017, 07:19:59 pm
content: Quote from: rdl on April 25, 2017, 07:00:52 pmBe very careful about point A. Open source is a double edged sword. While it allows for greater flexibility and collaboration, it also allows for malicious code to be added by sneaky developers such as happened with Heartbleed and numerous other open source hacks over the years.If you want the most secure OS possible you will not want it to be connected to the internet, ever, all updates would be done via usb or CD. Spreadsheet software is fairly secure, but stay away from anything Cloud based and if possible password protect the files.Generally speaking Unix, or variants of such are considered the most "Secure" and for general purposes OpenBSD is considered the most secure OS. Though as james_s mentioned:Quote from: james_s on April 25, 2017, 06:35:01 pmIf the admin doesn't understand the system then it will not be secure. Even Windows can be fairly secure with the right administrator to set up the security policies. A good rule as well is that general use user accounts (web browsing, spreadsheets ect.) should NOT have admin rights on a system that you want to be secure.

author: Halcyon
author_rank: Unknown
timestamp: April 25, 2017, 07:47:41 pm
content: Quote from: Terrius on April 25, 2017, 07:19:59 pmVery good advice. There have been several Linux distros where versions have had to be pulled because someone decided to add malicious software.As you said, Windows can be very secure, if you keep it up to date and know what you're doing. You can do your own penetration testing using Live CDs such asKali Linux.

author: rdl
author_rank: Super Contributor
timestamp: April 25, 2017, 08:04:12 pm
content: Quote from: rdl on April 25, 2017, 07:00:52 pmI was not implying that any of those four qualities guaranteed a secure operating system, only that they would likely be true for one that was.

author: free_electron
author_rank: Super Contributor
timestamp: April 25, 2017, 08:39:18 pm
content: a powered off computer if most secure. if you fill all io connectors with cement and remove the wireless modules it is even more secure.

author: rob77
author_rank: Super Contributor
timestamp: April 25, 2017, 09:06:45 pm
content: Quote from: free_electron on April 25, 2017, 08:39:18 pmand bury it at least 6 feet deep to add yet another layer of securityQuote from: james_s on April 25, 2017, 06:35:01 pmcouldn't agree morebtw... LInux + Chrome is considered a good option for browsing. just because of the fact there is significantly less malware and significantly less viruses (next to none) for linux. and the architecture/concept of chrome browser adds an additional layer of security.

author: Kjelt
author_rank: Super Contributor
timestamp: April 25, 2017, 09:19:14 pm
content: The problem with most OSs is that they are not only an basic OS of a few MBs but bloated to a multi GBs Omni software visual demonstrator and then at the end they add securityNew development that might be interesting, a security firm that writes their own OS with as startingpoint security:https://os.kaspersky.com

author: Bicurico
author_rank: Super Contributor
timestamp: April 25, 2017, 10:21:56 pm
content: 1) Many computers and laptops use BIOS/UEFI with backdoor2) Many network cards use BIOS with backdoor3) Many routers/access points/modems use firmware with backdoorThe question is: HOW secure are we talking about?a) Total security -> build your own computer, BIOS and OS and do NOT connect it to the internetb) Secret Services can monitor/remote control, but not hackers -> use proven Router/Access Point/Modem with latest firmware, boot OS from DVD, use secure passwordsc) Good enough to be covered by bank policy if things go bad -> use Linux/Windows in the latest version with all updates installed, use latest browser, use secure passwords, do NOT open attachments, do not install software from unknown source. Preferrably use two computers: one for work/money related stuff, the other for hobby, surfing, games, etc.The point I am trying to reach is:- Security, as already stated before me, depends on the user- There is no "secure OS" - if you do stupid things, it will open vulnerabilities like any other OS- Once connected to the internet, all you do IS being monitored, no matter what- IT espionage goes beyond the OS: it happens on hardware/firmware levelRegards,Vitor

author: AG6QR
author_rank: Frequent Contributor
timestamp: April 25, 2017, 10:24:55 pm
content: Lynx would be my bet for the most secure browser, simply because it does so little. Run it from a bootable CD on a machine with no hard drive, and enjoy the feeling of invulnerability!

author: james_s
author_rank: Super Contributor
timestamp: April 25, 2017, 10:26:13 pm
content: For the stuff we do that has to be really secure, it's handled on machines that are physically isolated from the corporate network in a secure area. Any data that needs to be transfered is done via "sneakernet" using CDs or USB thumb drives. No security is perfect but this has been good enough.

author: Terrius
author_rank: Contributor
timestamp: April 25, 2017, 10:40:21 pm
content: Quote from: wilfred on April 25, 2017, 09:22:34 pmIndeed, as I said, double edged sword. The biggest issue with open source software is lazy vetting of code, the larger the project gets the more likely it is for exploits to slip through the cracks, and when they do there is no entity that can be held accountable due to the nature of working under open source licenses. We're even at a point where no one person has the capability to vet the entire Linux Kernel, so you have to take it on faith that other developers are vetting it for you.My point was simply that section A to which I was referring, should never be a priority when looking for something for security. It may be that open source is your best option, but you shouldn't choose anything "secure" just because it is open source.So honestly if the OP isn't a well versed system admin with years of Linux or Unix experience (it is very easy in most distros for a newbie to leave huge security gaps in linux when they install it, or worse to poke holes in it by accident) I think the only real suggestion if they want something very secure is a completely isolated from the internet PC that is updated over USB or CD and never hooked up to the network. Be aware however that malicious code can be easily transfered across from a USB stick or CD if the content is already infected, so you must also vet anything you intend to transfer to the isolated system.I forgot to add, for browsing there isn't much better than Chrome or Microsoft Edge currently (from an updating and bug squashing perspective.) Opera has some extra security measure but isn't as easy to use. Though there are Chrome branches like Comodo Dragon, that claim better security features and do disable a lot of the dubious chrome functions.

author: Jr460
author_rank: Regular Contributor
timestamp: April 25, 2017, 10:47:12 pm
content: Quote from: james_s on April 25, 2017, 10:26:13 pmNo USB, also what goes in never comes out unless it is shredded or completely destroyed.Really you want your home machine to be secure? The simplest thing to do is don't use an account that has admin privs. It will make it hard when you download something and then want to install it, you have to logout, login as admin, install, log out, login and dumb user....Also use two different browser, one for your online banking, close it down, then use a different one for everything else. No cookies or tracking going from one to other. Also don't have both browsers open at the same time.That will not protect you from everything, but the most cases, your user account gets trashed, not the whole machine.I think if I wanted a secure OS to browse from........I'd run a VM that is running a VAX emulator, with OpenVMS loaded and Mosaic as a browser. Take that hackers.

author: Zero999
author_rank: Super Contributor
timestamp: April 26, 2017, 08:05:01 am
content: Quote from: wilfred on April 25, 2017, 09:22:34 pmThat's true. With proprietary software, the developer could easily introduce various back doors that only they know about, so they can then control your system. They may suspect you're using an unlicensed copy or violating the EULA, shut down your system and prevent you from accessing your data, until you pay them a fee.

author: R005T3r
author_rank: Frequent Contributor
timestamp: April 26, 2017, 05:27:26 pm
content: "security" today is relative. If someone wants to breach your system he will breach it, period. However, depends with who you are dealing with: As I tried to explain, one thing is dealing with government agencies (and there there's little to no way to prevent them for entering, as for them 1mln $ is a reasonable amount, yep, if it's reasonable, I'd accept the deal and save their time) and another thing is dealing with everyday dangers on the web and in the real world, which is not a serious problem provided you know what to do.If you have to use a browser to do sensible things and you have to be connected I'd:1. use linux only and not windows2. use separate browsers for different things: you use only one to surf on sensitive sites and the other one to do other things.3. adblock everywhere.4. if you have to bring your laptop with you, encrypt everything: in case someone seals it he won't be able to bypass it (and a trick is writing the nuke password in the pc back). The thief will probably erase the disk, but your intel are secure...Also, using 2 step auth is a great feature that will boost your security a lot. Use open source software and update your system frequently.

author: Kilrah
author_rank: Unknown
timestamp: April 26, 2017, 06:06:28 pm
content: Quote from: Jr460 on April 25, 2017, 10:47:12 pmOn windows it's kinda pointless nowadays with UAC. Just think twice before clicking yes to an UAC prompt.Nobody would use linux with a full access account and with sudo you don't need.Mac OS also requires authentification for sensitive stuff.

author: james_s
author_rank: Super Contributor
timestamp: April 26, 2017, 06:14:59 pm
content: I'm skeptical of the effectiveness of UAC. I think most people get in the habit of just clicking it to get past, I know I've been guilty of being on autopilot. Fortunately I'm pretty careful about what I install to begin with, and you have to be really vigilant these days. Even reputable software is getting bundled with malware/crapware that is deliberately deceptive in the installer. Even I got burned once, agreeing to a EULA that I thought was for the program I was installing but turned out to be for some advertising crapware that used virus-like techniques to obfuscate itself and make removal difficult.

author: Kilrah
author_rank: Unknown
timestamp: April 26, 2017, 06:26:09 pm
content: Yeah. My point is, if you downloaded something you believe is OK you're going to install it, having to go through the hoops of logging out of your dumb user account and back in as admin won't make a difference.

author: james_s
author_rank: Super Contributor
timestamp: April 26, 2017, 07:35:43 pm
content: That is probably true. The most effective use of limited accounts is to have a separate administrator who handles that stuff but that's not always practical. UAC could be useful in preventing programs from making changes without the user knowing.

author: VulcanBB18
author_rank: Contributor
timestamp: April 28, 2017, 01:08:32 am
content: If you are concerned with security on a windows box with regards your account, run it as a normal user with no rights to do anything.Then when you do need to install, you can elevate your privileges by shift-right-clicking on the EXE or whatever in question, and selecting "Run as different user" from the popup menu. You get a logon prompt, put in the login credentials, and that processonlycan run with the rights required to install.After that ensure patching is up to date and the whole thing is behind a properly secured firewall, or failing that a well configured router. Then it's just down to the chair-to-keyboard interface problemcheers,

author: nowlan
author_rank: Frequent Contributor
timestamp: April 28, 2017, 02:37:55 am
content: I remember someone saying to use Chrome, they patch 0days inside 3 days normally, and the malware guys usually take a week to reverse the patch etc. Plus it auto updates a lot. Probably some more sandboxing but I dont know the details.

author: james_s
author_rank: Super Contributor
timestamp: April 28, 2017, 03:06:41 am
content: I don't know if I trust Chrome though, I've heard accusations that it does some serious data harvesting, I never looked into it though because I don't care for the interface anyway.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: April 28, 2017, 03:18:29 am
content: Almost all of these replies deal with software vulnerabilities and practices. For total security you should also have total control over your hardware. Meaning you you know all of the firmware in the mice, keyboards, motherboards and so on. Attacks on high interest targets have involved a variety of hardware and I am sure these techniques have been spread widely. It is one reason USB drives are now not allowed on secure systems.It bears repeating over and over. There is no such thing as total security on publicly purchase hardware, with commercial or free software and with connection to the internet. The question is how much can you afford to have exposed.

author: rdl
author_rank: Super Contributor
timestamp: April 28, 2017, 05:48:47 am
content: As I understand it, Google provides the basic Chrome code as open source, but the actual Chrome browser has a number of closed source, proprietary "features". The Chromium browser is apparently based only on the open source part. I've never used either. I would never even consider trying Chrome.

author: Kilrah
author_rank: Unknown
timestamp: April 28, 2017, 06:46:56 am
content: Quote from: VulcanBB18 on April 28, 2017, 01:08:32 amI can't remember how many times I've tried to find a way to do this (without going through a runas shortcut), thanks for the well-hidden shortcut.

author: Rick Law
author_rank: Super Contributor
timestamp: April 29, 2017, 12:29:48 am
content: Thanks guys for so many valuable suggestions.I am due to replace my current browsing system. This will give me fruit for thought.

author: SeanB
author_rank: Super Contributor
timestamp: April 29, 2017, 01:46:12 pm
content: Quote from: rdl on April 28, 2017, 05:48:47 amChromium yes, it is always a little behind the bleeding edge, but a nice browser. I just like the Firefox add on system, buggy though it is, as it is more versatile. Little things like Noscript, Adblock, Ublock origin and Requestpolicy make surfing a lot safer and more enjoyable.So half the sites have no ads, I can always find the content they "protect" with a simple google search anyway, or just use the cached version of it the crawler kept.