2

On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows:

su  FirefoxUserName -c 'firefox'

Where each browser would have a user account and have his own /home directory and have no privileges.

I do however understand that my browsing history as well as downloads would still be on this different account so those would remain accessible.

  • If you want to be extreme, you may think about deploying a docker container and run firefox from There! – Nick C. May 26 '16 at 16:13
  • In that case, if the browser is compromised, the attacker would be isolated within the container. – Nick C. May 26 '16 at 16:20
3

Yes - beneficial, although it doesn't fix everything.

Being hacked through your browser is one of the most common ways you'll be hit. If the browser is running as a user that doesn't have access to your private files, your web cam and such, then the impact of a hack is much less.

There are still risks. If the hacker uses a local privilege escalation exploit, they can bypass the sandbox. Depending on how the sandbox is done, the hacker may get access to all you web traffic - and steal all your cookies. And this does nothing to protect you against phishing and other attacks.

In fact, this is such a good idea that many browsers do a similar thing anyway: the browser sandbox. Off the top of my head, Chrome does it on Windows and Linux, Firefox does it on Windows only. Some Linux distributions have an AppArmor profile for Firefox that achieves a similar result.

If you're keen, take a look at Qubes OS.

2

Similar to XKCD Authorization, however replace "stealing the laptop when logged in" with "executing processes in the context of my user".

XKCD Authorization

So, yes, they might not be able to get at your user account itself in your case, so local files would be protected, but they could get access to all your active sessions within your browser.

Add in a priv escalation exploit though (or something else vulnerable on your particular machine only that allows priv esc), then the attacker could gain access to your files or take over the whole machine.

So it might add another thin layer of security, but may cause inconvenience in other respects such as file downloads will have to be written to the home directory of the additional account, and uploads may be more tricky.

1

If you're really concerned about security issues, you might consider running Firefox in a separate virtual machine. That way it should be extremely hard - though not impossible - to harm either your pc or your personal data.

I don't know for sure, but there may be a nice side effect: I've heard, that lots of viruses check if they're being run on a virtual machine in order to check if their victim is likely some kind of lab. That way chances are that a lot of viruses and trojans will not even try to infect that machine.

0

You should first define security. Are you concerned about being tracked or leaving trace locally?

I would recommend you to launch Firefox in Private Browsing. This avoids using the cookies for your Firefox standard browsing, in other words, you're not keeping the browsing information, such as history, cookies in your computer* (because all local information is removed after private browsing is closed). Please note that this is not the same as browsing anonymous over internet (without been recognized).

You can find useful information in the link below Firefox Security settings I Also recommend you to use this firefox extension in order to stop website from tracking you Do not track me

*The files that you have intentionally downloaded are kept.

  • Given what OP has tried already, I think he is concerned about exploitation. – forest Mar 29 '18 at 6:25
0

It is generally better, but it depends on that users' rights: if it can't do anything outside a FF folder and can not see other users/groups processes - then it is a benefit for sure!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.