2

On the ArchWiki, it is suggested, as a security measure, to run skype as a different user. My question is: would this make sense for the browser? I use firefox with NoScript and AdBlock, but also need to have Java and Acrobat Reader plugins, so... would the suggested approach be of some use?

2

So in theory running an application as a separate user may provide some security benefit in that in the event of the application having a security issue, the application may not be able to access data belonging to the primary user.

That said against that you need to weigh the usability problems of your browser not necessarily having access to data for your primary user. Also this approach only provides a benefit if you have relatively restrictive file permissions (e.g. it doesn't help protect files that are world readable/writable)

| improve this answer | |
  • I understand that, but what I had in mind when I asked this question (and I should have stated it explicitly) was remote code executions: if that happens, running the browser from a separate account does limit the damage, right? – wmnorth Nov 18 '13 at 0:18
  • Potentially, in that it might make it harder for them to carry on exploiting your user, however in reality privilege escalation bugs are a lot more common than RCE, so if they get RCE and they're determined, they can probably get priv. esc as well... – Rory McCune Nov 18 '13 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.