Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I step away for a minute while my browser is open, ...
As I previously implied on another post quoting this comic, the problem is that fundamentally, if you leave your screen unlocked the OS has no way to tell that the person typing and clicking is not in fact you. It has already authenticated you, and for now it is just checking you are authorised.
"You" are completely authorised to change your facebook status to "I am a fool" inserting "your" choice expletives!
There is a solution to this - force the user to periodically re-authenticate. Unfortunately, to protect against the case of "I walked out the front door (away from my laptop) leaving it unlocked and open (did not lock screen)" you'd essentially need something that looked like UAC on LSD - "please re-enter your password to copy that file. And again to rename it. And again to open it" and so on.
and I come back and my computer is gone, basically all my online accounts are hosed.
That's not quite true. It really depends on the web account in question. For many accounts, whilst you do not need to re-authenticate to do some reputation damaging actions, there are some defenses:
- Account sessions aren't maintained indefinitely, for this reason. After a certain amount of inactivity, accounts usually time out.
- Changing sensitive account properties - like the password of the account or critical settings - can require re-authenticating.
Or are there features to close a browsing session remotely -- including clear cookies -- in any of the major browsers, most of which I know can sync this data between devices?
I don't use browser syncing, but I suspect the answer is as always - vs a sophisticated enough attacker, this would not help.
However, there is again hope. Some web based services use API keys or equivalent to authenticate machines - so you can indeed invalidate for example your dropbox account on that system. Google Apps "Application Passwords" are another good example of this.
which lock the browser itself after a certain amount of time or my computer goes to sleep/standby, where I have to authenticate to resume my session?
I'm not sure what use just locking the browser would be. To put this into context, the attack vector in this case is "someone who is not you, but fully authenticated as you". That's almost impossible to build defences against.
Indeed, the point of the comic, that "they could do everything but get to root" doesn't really apply to this attack vector. For starters, physical access probably will let you get to root one way or another, but more importantly those defences are to protect applications which are authenticated as you and have been compromised from further compromising the system in an automated fashion - this is particularly relevant when you are not the only user of the system.
There is a massive argument that in fact further isolation is needed at the desktop level between individual applications for a single user - e.g. between browser tabs as per the chromium sandbox, separate levels of Window that cannot interact e.g. UIPI, fully isolated applications via hypervisor e.g. Qubes. There are people building sandboxes on Linux e.g. 1 2 3. You can sandbox Windows further with say Sandboxie.
All of these neat little solutions to the malware-infects-your-browser-tab-but-is-isolated-from-your-bank-session cannot protect you from "yourself". The input device is still completely trusted once the "trusted" gui is unlocked.
The best defence you can really offer yourself has already been mentioned:
- Lock your screen.
- Encrypt your disk.
As has been noted, you are not fully safe against cold boot attacks, but I suspect a casual thief is not capable of implementing one successfully.