If someone steals my laptop while I'm logged in, how can I protect my browser?

Question

My question has its roots in an xkcd from this week:

http://xkcd.com/1200/

Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I step away for a minute while my browser is open, and I come back and my computer is gone, basically all my online accounts are hosed. Now, I get it: don't leave your computer unattended, logged in, etc, but just suppose that I, as a human, make a mistake. Is there another layer of security on the browser level at all?

In other words, are there "browser lock" features on any of the major browsers, similar to the host OS lock features, which lock the browser itself after a certain amount of time or my computer goes to sleep/standby, where I have to authenticate to resume my session? (A hotkey to lock the browser could be useful, for instance, when you want to just quickly hand your computer to somebody next to you to use without having to make a guest account, switch users, etc...)

Or are there features to close a browsing session remotely -- including clear cookies -- in any of the major browsers, most of which I know can sync this data between devices? Would either/any of these be effective for various situations?

Answer 1

Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I step away for a minute while my browser is open, ...

As I previously implied on another post quoting this comic, the problem is that fundamentally, if you leave your screen unlocked the OS has no way to tell that the person typing and clicking is not in fact you. It has already authenticated you, and for now it is just checking you are authorised.

"You" are completely authorised to change your facebook status to "I am a fool" inserting "your" choice expletives!

There is a solution to this - force the user to periodically re-authenticate. Unfortunately, to protect against the case of "I walked out the front door (away from my laptop) leaving it unlocked and open (did not lock screen)" you'd essentially need something that looked like UAC on LSD - "please re-enter your password to copy that file. And again to rename it. And again to open it" and so on.

However...

and I come back and my computer is gone, basically all my online accounts are hosed.

That's not quite true. It really depends on the web account in question. For many accounts, whilst you do not need to re-authenticate to do some reputation damaging actions, there are some defenses:

• Account sessions aren't maintained indefinitely, for this reason. After a certain amount of inactivity, accounts usually time out.
• Changing sensitive account properties - like the password of the account or critical settings - can require re-authenticating.

Or are there features to close a browsing session remotely -- including clear cookies -- in any of the major browsers, most of which I know can sync this data between devices?

I don't use browser syncing, but I suspect the answer is as always - vs a sophisticated enough attacker, this would not help.

However, there is again hope. Some web based services use API keys or equivalent to authenticate machines - so you can indeed invalidate for example your dropbox account on that system. Google Apps "Application Passwords" are another good example of this.

which lock the browser itself after a certain amount of time or my computer goes to sleep/standby, where I have to authenticate to resume my session?

I'm not sure what use just locking the browser would be. To put this into context, the attack vector in this case is "someone who is not you, but fully authenticated as you". That's almost impossible to build defences against.

Indeed, the point of the comic, that "they could do everything but get to root" doesn't really apply to this attack vector. For starters, physical access probably will let you get to root one way or another, but more importantly those defences are to protect applications which are authenticated as you and have been compromised from further compromising the system in an automated fashion - this is particularly relevant when you are not the only user of the system.

There is a massive argument that in fact further isolation is needed at the desktop level between individual applications for a single user - e.g. between browser tabs as per the chromium sandbox, separate levels of Window that cannot interact e.g. UIPI, fully isolated applications via hypervisor e.g. Qubes. There are people building sandboxes on Linux e.g. 1 2 3. You can sandbox Windows further with say Sandboxie.

All of these neat little solutions to the malware-infects-your-browser-tab-but-is-isolated-from-your-bank-session cannot protect you from "yourself". The input device is still completely trusted once the "trusted" gui is unlocked.

The best defence you can really offer yourself has already been mentioned:

• Lock your screen.
• Encrypt your disk.

As has been noted, you are not fully safe against cold boot attacks, but I suspect a casual thief is not capable of implementing one successfully.

Answer 2

Make it require a password when the screensaver comes on. Make the screensaver come on after 5 minutes. I've also used a small utility (BtProx) which uses bluetooth to determine if you're close. When you walk away with your phone it locks the computer. You can also use something like LemonScan which uses your webcam to determine if you're using your computer and locks it when you walk away.

Use disk encryption like TrueCrypt on the system volume so that once the machine is restarted the user cannot get back in.

If you do not encrypt the system volume and just encrypt a drive containing your browser profile then you should turn off hibernate so that the TrueCrypt password is not saved to disk which allows it to be recovered easily.

It's still good to not run as the admin on your computer. If you're logged in as an admin a passer-by could install key-logging and trojan software on your machine and probably do more damage than by stealing your computer.

Using OpenID or Google for central authentication does allow you to disable access to sites that use OpenID for authentication.

Answer 3

Well, the best solution here would be to lock the laptop before you go via a screensaver interface or small utilities (like 'slock'). This way, even if the laptop gets stolen, the villain will have to reboot it and face the same problem with logging in. Of course this is not a problem to get the root (in case it's linux) but then the user data (like dropbox login or saved passwords in firefox) will remain untouched.

EDIT: Although the root can change the user password and then the user account is screwed. Then the only solution here would be to make a script that erases sensitive data after a couple of failed logins. Can be dangerous if there are kids around.

Answer 4

You could use private browsing and before leaving your laptop close the browser window that has sensitive information.

http://en.wikipedia.org/wiki/Privacy_mode

Answer 5

USB Tethered to wrist. (Overkill)

Run an entire OS temporarily from a USB stick. When you want to log in, shut down comp, enter USB stick, load from it, log into your accounts, when done, log out, shutdown computer, unplug USB stick. No traces (that lead to credential parsing), easy to destroy, easy to hide... Safe?

• Adding a jumper module onto the USB chip inside the USB drive shell, primarily the one that links the drives memory to the external bus. When no jumper is there then it appears damaged. Pop open the case and add the jumper, fully functional. Not hard if you have a solder gun, a knife (to sever the connection bridge), 2 prong jumper(or just make one by cutting needles). And a USB drive that is able to hold your configuration.