How to create secure portable firefox?

Question

When I need to access our school web portal I need to access it with my certificate (pfx). Since certificate needs to be installed in browser, I'm thinking (out of security reasons) to create a portable version of firefox. So I would buy a new usb stick, encrypt it's file system with TrueCrypt, so that every time I try to access it I have to enter my password. On it I would copy paste the newest versions of windows/linux firefox. To run FF from usb I would create a script with the startup switches like on this and this site in order to not mess up with any existing firefox profile and to not leave any trace on the pc where I would use my usb stick. Is this ok from the security point of view, have I missed something else?

Question is: Is this a secure way of having a portable FF? Since the later will be used only to access school portal from any machine in any network it needs to secure. By secure I mean: no one can misuse my login and/or certificate, I leave no browsing track/history on the host machine, my certificate can not be stolen, etc. In other words, what are possible security flaws in the setup I mentioned?

Jonathan has a few good points, however it all may look a bit exaggerating. What I'm dealing with are mostly home, free wifi and little corporate networks. So I don't need to be extra paranoid that content of my usb will be copied during usage, even though it could be. But there is a workaround even in this circumstance... I would create a bootable usb disk with a minimal linux distro, the only prerequisite here is that I can boot PC from usb and a DHCP network, and that should be all. In this case the only monitoring that can be done by admins is network traffic on routers, but they shouldn't get much info in my case, they can get the url I connect to and that's almost all, the traffic content is encrypted.

It's true, software needs to be up to date, so I would need to update FF at least once a month.

Are there any other security flaws in the idea I propose, I mean something like:

1) browser leaving tracks somewhere

2) type of encryption on usb

3) which file system to choose

Answer 1

Welcome to Information Security Stack exchange! This is an interesting idea you are proposing, and here are some thoughts I have on it. Overall, I believe it would provide you personally with an added layer of security if the admin permits it. You could get into trouble if the idea violates their system security policy though, so be sure to check before you do it. Here are my thoughts:

USB sticks are bad for security of the host systems (but may work for your situation):

I know many admins do not allow USB because they are a "good way" for malware to spread. For example, malware could be spread by USB in the following ways:

• The USB stick manufacturer could pre-install malware on the USB stick.
• A hacker can transfer malware to a system over a USB stick.
• The unsuspecting user can transfer malware that has unknowingly infected their USB stick.

It will probably help your own security, if it is permitted:

If your admin is okay with using USB sticks, you might gain some security with your method. Because of the malware threat with USB sticks, unfortunately, your idea probably would not be a good "overall" security standard solution. Your idea will probably add some to your own security if it is permitted.

The comment posted by @user2313067 is a very good point, that it will not provide full security because the host machine can read what is on your USB stick. However, I believe the admin would have to be fairly determined to get to your information to go through the measures described in the comment. I believe it is unlikely (but not impossible) that the admin would be after your info though, and would be this determined to get it.

Potential for trouble:

This could violate system security policies that are already in place too (e.g. a good admin would not want a potential attacker to be able to run any arbitrary software off their USB stick). To avoid getting into trouble, you will probably need to ask the admin if you can do it.

Keeping up to date:

One thing to be on the lookout for is that the FireFox browser (and probably all other browsers) have vulnerabilities that are sometimes discovered. Because of this, it is important to keep your browser up to date (as the vendor releases new updates to fix discovered vulnerabilities).

Further input:

I am pretty sure I have not thought up all the pros and cons of his / her idea, and I look forward to seeing further thought on it.

Answer 2

USB drive

• USB drive might be prohibited on computer system you try to use (especially company and school computer systems)
• USB are inherently insecure: firmware on such usb stick can be updated without your knowledge for most of USB drives on the market. Such USB drive would not be able to modify files on it (since everything would be encrypted).

Portable firefox

• Portable firefox needs to be updated form time to time. You will have remember to download newest version and update your certificate each time.

Legality

It might not be acceptable in some organisations to use non-company issued browsers with attached software to verify what webpages are you accessing and to harvest your username/passwords.

My solution

I would use phone, or other dedicated device to access school portal. Phone has advantage of being able to use external GSM network almost everywhere in addition to every WIFI spot you can connect to. It's usualy pretty secure (especialy iPhones and maybe Google and recenlty updated Samsung phones) and it's hard to get to password/certificate without proper authorisation.