lately I've been using the guest session on my xubuntu install because I am lazy and I was wondering what the security implications can be on the rest of the system if there is a web browser exploit or similar attack. Apparently it wipes the entire guest session every time you log out or it goes idle. Would a better alternative be just a regular user account?
Let's get into the details of what a guest session is on Ubuntu. You've asked 'is it more secure for the system to use a guest session rather a normal account?', and the answer is yes, but only slightly.
Guest sessions use a
tmpfs instead of a home, so data does not get written to disk but stays in RAM. This means a prolongated session with important amounts of changes might cause your system to need swapping.
Processes in the session can only create TCP and UDP connections, although I'm not sure what the expected security benefits are (apart from preventing PPTP tunnels?).
AppArmor is used to ensure that this session cannot possibly write to the system, except for its own home and
/tmp. This should normally cover cases when a root privilege escalation occurs within the guest session, but not attacks against the kernel itself. A regular account would not provide you with this kind of protection.
Yes, it wipes the whole session (more concretely, the $HOME of the guest user). An attacker would need to enter into another account (either root or eg. a normal user with a weak password).
Unless it manages to do so, any change will disappear on logout, which is nice for security, but inconvenient for users.
However, that things are wiped doesn't mean they that -if filesystem permissions allow them to- it couldn't write files on other locations, or send away data about your system.
Would a better alternative be just a regular user account?
As an alternative to what? For running browser exploits? No.
For normal Xubuntu usage? Probably. It will depend what you want to do there.