Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My question has its roots in an xkcd from this week:

http://xkcd.com/1200/

If someone steals my laptop while I'm logged in, they can read my email, take my money, and impersonate me to my friends, but at least they can't install drivers without my permission.

Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I step away for a minute while my browser is open, and I come back and my computer is gone, basically all my online accounts are hosed. Now, I get it: don't leave your computer unattended, logged in, etc, but just suppose that I, as a human, make a mistake. Is there another layer of security on the browser level at all?

In other words, are there "browser lock" features on any of the major browsers, similar to the host OS lock features, which lock the browser itself after a certain amount of time or my computer goes to sleep/standby, where I have to authenticate to resume my session? (A hotkey to lock the browser could be useful, for instance, when you want to just quickly hand your computer to somebody next to you to use without having to make a guest account, switch users, etc...)

Or are there features to close a browsing session remotely -- including clear cookies -- in any of the major browsers, most of which I know can sync this data between devices? Would either/any of these be effective for various situations?

share|improve this question
9  
This type of attack calls for a martial arts course. –  Deer Hunter Apr 20 '13 at 6:25
1  
I have my laptop configured so it runs i3lock when I close the laptop lid. That plus disk and swap encryption and a bios password. –  lynks Apr 20 '13 at 11:33
    
With physical access (assuming intelligent criminals) your only hope is a drive wiping "trap"..... On second thought full disk encryption would do some good but not for the situation you posed. –  David Apr 20 '13 at 23:40
    
Why just lock the browser when you can use the operating system lock to lock your entire login session? –  Johnny Apr 23 '13 at 18:31
    
@Johnny I gave some reasons in my question. –  Matt Apr 23 '13 at 19:19
add comment

4 Answers

up vote 1 down vote accepted

Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I step away for a minute while my browser is open, ...

As I previously implied on another post quoting this comic, the problem is that fundamentally, if you leave your screen unlocked the OS has no way to tell that the person typing and clicking is not in fact you. It has already authenticated you, and for now it is just checking you are authorised.

"You" are completely authorised to change your facebook status to "I am a fool" inserting "your" choice expletives!

There is a solution to this - force the user to periodically re-authenticate. Unfortunately, to protect against the case of "I walked out the front door (away from my laptop) leaving it unlocked and open (did not lock screen)" you'd essentially need something that looked like UAC on LSD - "please re-enter your password to copy that file. And again to rename it. And again to open it" and so on.

However...

and I come back and my computer is gone, basically all my online accounts are hosed.

That's not quite true. It really depends on the web account in question. For many accounts, whilst you do not need to re-authenticate to do some reputation damaging actions, there are some defenses:

  • Account sessions aren't maintained indefinitely, for this reason. After a certain amount of inactivity, accounts usually time out.
  • Changing sensitive account properties - like the password of the account or critical settings - can require re-authenticating.

Or are there features to close a browsing session remotely -- including clear cookies -- in any of the major browsers, most of which I know can sync this data between devices?

I don't use browser syncing, but I suspect the answer is as always - vs a sophisticated enough attacker, this would not help.

However, there is again hope. Some web based services use API keys or equivalent to authenticate machines - so you can indeed invalidate for example your dropbox account on that system. Google Apps "Application Passwords" are another good example of this.

which lock the browser itself after a certain amount of time or my computer goes to sleep/standby, where I have to authenticate to resume my session?

I'm not sure what use just locking the browser would be. To put this into context, the attack vector in this case is "someone who is not you, but fully authenticated as you". That's almost impossible to build defences against.

Indeed, the point of the comic, that "they could do everything but get to root" doesn't really apply to this attack vector. For starters, physical access probably will let you get to root one way or another, but more importantly those defences are to protect applications which are authenticated as you and have been compromised from further compromising the system in an automated fashion - this is particularly relevant when you are not the only user of the system.

There is a massive argument that in fact further isolation is needed at the desktop level between individual applications for a single user - e.g. between browser tabs as per the chromium sandbox, separate levels of Window that cannot interact e.g. UIPI, fully isolated applications via hypervisor e.g. Qubes. There are people building sandboxes on Linux e.g. 1 2 3. You can sandbox Windows further with say Sandboxie.

All of these neat little solutions to the malware-infects-your-browser-tab-but-is-isolated-from-your-bank-session cannot protect you from "yourself". The input device is still completely trusted once the "trusted" gui is unlocked.

The best defence you can really offer yourself has already been mentioned:

  • Lock your screen.
  • Encrypt your disk.

As has been noted, you are not fully safe against cold boot attacks, but I suspect a casual thief is not capable of implementing one successfully.

share|improve this answer
add comment

Well, the best solution here would be to lock the laptop before you go via a screensaver interface or small utilities (like 'slock'). This way, even if the laptop gets stolen, the villain will have to reboot it and face the same problem with logging in. Of course this is not a problem to get the root (in case it's linux) but then the user data (like dropbox login or saved passwords in firefox) will remain untouched.

EDIT: Although the root can change the user password and then the user account is screwed. Then the only solution here would be to make a script that erases sensitive data after a couple of failed logins. Can be dangerous if there are kids around.

share|improve this answer
    
Full disk encryption is a possibility too. But a good attacker would know how to do a cold boot attack to solve it. Ultimately physical access == no security. –  ewanm89 Apr 20 '13 at 7:58
    
How does a cold boot get around full disk encryption? –  Johnny Apr 23 '13 at 18:28
    
@Johnny The decryption key is stored into the RAM, so with a coldboot the attacker can take a snapshot of the RAM and find the decryption key. –  Francois Valiquette Apr 23 '13 at 19:39
add comment

You could use private browsing and before leaving your laptop close the browser window that has sensitive information.

http://en.wikipedia.org/wiki/Privacy_mode

share|improve this answer
add comment

Make it require a password when the screensaver comes on. Make the screensaver come on after 5 minutes. I've also used a small utility (BtProx) which uses bluetooth to determine if you're close. When you walk away with your phone it locks the computer. You can also use something like LemonScan which uses your webcam to determine if you're using your computer and locks it when you walk away.

Use disk encryption like TrueCrypt on the system volume so that once the machine is restarted the user cannot get back in.

If you do not encrypt the system volume and just encrypt a drive containing your browser profile then you should turn off hibernate so that the TrueCrypt password is not saved to disk which allows it to be recovered easily.

It's still good to not run as the admin on your computer. If you're logged in as an admin a passer-by could install key-logging and trojan software on your machine and probably do more damage than by stealing your computer.

Using OpenID or Google for central authentication does allow you to disable access to sites that use OpenID for authentication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.