Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
226

What processes and systems are in place so that Google is not able to copy the data on my computer? None. Google Chrome usually runs with the permissions of your user account. The application can then read and modify local files to the same extent your user account can. (These permissions apply to most of the programs you're using.) So you need to trust ...


94

However, after putting some thought into it I can't come up with a reason why shared executable code on an internal server shouldn't have 777 permissions. Because you're not only trusting every user - which might be reasonable on an internal server where "everybody" who has access should have that control - you're also trusting every process on that ...


85

A piece of unsandboxed software running on a PC/Mac has (generally) the same privileges as the user running it and therefore can access any data that can be accessed by the user. You are trusting Google (and any other software vendor whose code you execute) not to do anything malicious with that access. If you don't trust Google, your only option as a ...


48

As far as I know there is no feature like that in Adobe Reader. But even when there were such a feature, it couldn't be effective. PDF is an open format, so they could just use another PDF-capable program to view it which doesn't support this feature They could create a copy of the file before opening it. Adobe Reader couldn't know about that second copy, ...


38

If you are running a Linux distribution with SELinux, it is possible to have an additional layer of security. SELinux is an OS-level technology which allows tight restrictions on what processes — like your browser process — can access. In fact, in Fedora and in Red Hat Enterprise Linux (disclaimer: I work for Red Hat, on Fedora!), there is a light ...


30

Use Process Monitor with a filter to watch the hosts file. Run it long enough and you will see everything that changes the file. http://technet.microsoft.com/en-us/sysinternals/bb896645


30

There is a way to distribute the risk such that any single print-shop gains no benefit from copying your files: Visual Cryptography. But it is esoteric and it is hard-core - versus simply buying your own printer or eBook reader. To print PDFs at untrusted print-shops with visual cryptography, you use special software to split each page into two parts - ...


28

A call to fopen is not in itself a TOCTOU vulnerability. By definition, TOCTOU involves two operations: a “check” and a “use”. A common example of TOCTOU vulnerability is checking access permissions with access before opening a file. It's a bug (race condition) because the permissions might change between checking and opening, and it's usually a ...


25

I'm gonna second @gowenfawr and say that breeding better chimpanzees is a goal unto itself here. (now I will extrapolate wildly about your corporate culture) At my software development company, we've been seeing an increasing trend of customers asking for evidence of our security practices not just in production environments, but also in our development ...


23

Lawyers. You have a contract with Google stating what they will do / you allow them to do. This is called the Google Chrome Terms of Service . And obviously, you have carefully read it before installing it. This includes¹ excerpts like this (emphasis by me): By default, usage statistics and crash reports are sent to Google (…). Usage statistics contain ...


21

Why there are not already more anti-crypto-ransomware tools? Because there are. They are called virus scanners and they should have heuristic algorithms to detect this behavior. Unfortunately the ransomware-developers are smart enough to test their creations against all commonly used virus scanners and make sure they circumvent their heuristics somehow. ...


20

There's no technical way to solve this. The file (or, rather, a version of it) will be stored in the computer's cache for some time, and sent to the printer which will keep it there for some time. There are several places where a version of your file can be intercepted and stored. If you don't trust the copy shop, get your own printer.


18

What processes and systems are in place so that Google is not able to copy the data on my computer? There's not anything in place that makes it so they can't but there's something in place that makes it unlikely that they would: trust. Google's product is you. They want to know everything about you and be able to predict every single decision that you will ...


12

The built in windows auditing can do this if you're running a domain, or at least windows 2003/Vista and are willing to set it up in group policy. Enable object access auditing and then set up the files and folders you want to audit. There are a large nunber of tools that can then read and sort/filter the windows logs ... I'm a fan of GFI EventsManager, but ...


11

It's exceedingly difficult to block Skype file transfers at the network level. They've designed it to use common ports (80 / 443) and proprietary encryption (albeit an extension to SSL) along with UPnP NAT holepunching to ensure absolutely minimal conflicts and setup issues. Remote file transfers go through supernodes as part of a P2P architecture, so it's ...


11

The concept is that on a given "object" (say, a file), you have access permissions which detail who can access the object and under which conditions. The owner is an optimization: usually, among all the users who have permissions for a given object, one of them should have "all the permissions" and be generally considered as responsible for this object. On ...


10

This is not a problem that cryptography can solve. This is problem that can only be addressed with the Operating System's Access Control by removing read privileges to the file. Or put another way, DRM is a fundamentally flawed approach, and will never work.


9

It is possible to make one-way Ethernet cables. This site has lots of pointers to various documentations for that. Note that things change depending on whether you are doing 10 MBits/s, 100 MBits/s or 1 Gbits/s (10 MBits/s is easy: simply cut off one pair; 100 MBit/s is tricky; gigabit seems infeasible since the signal uses phase modulation over all eight ...


9

Your suggestion is interesting; unfortunately a generic solution is not possible as there is no combination of bits that would cause an encryption algorithm to "stall". Encryption is just math, after all. Perhaps use of a rootkit could trick ransomware into believing that it's encrypting a fake yottabyte-long dummy file handle, or it could have delays ...


8

I faced similar problems. I solved it by following these steps Right click on hosts file go to properties. Go to the Security tab. Under Groups and users go to the System and edit permissions. Deny write permissions for the System. Press OK and Done.


8

Files always have a owner-id and a group-id. But if the files are copied from another system (e. g. extracted from a tar archive), there may be no name assigned to those ids. At a later time a new user or group may be created which gets the next available id. This id, however, may be the same id as the one used improperly before. As a result the new user/...


7

This idea is in no way specific to web browsers. You could make the same argument that every application the user runs deserves to have its own segregated user ID under which to run. Yes, some measure of security would arguably be gained by doing this because (for example) the malicious music player running in the same desktop session couldn't access the ...


7

Grsecurity is not a pure pathname-based MAC system like TOMOYO or AppArmor. Policy is described using pathnames (same as every other system, including SELinux), but these are converted to inode/dev pairs at enable time and used thereafter. Pathnames are only used when matching regular expressions from policy or to provide "policy-recreation" -- given the ...


7

if the hard drive stolen and cross OS are two different condition! If stolen, mounted in another host, all permissions are compromised, everybody could be root in his host and mount hard-drive (maybe externaly by USB - Sata changer) with all needed rights. For this condition, (strong) encryption are the only way. About cross OS, if drive stay mounted in a ...


7

Create a new user. Give that user access rights to only the folders you want to share. You can use the File and Folder Permission options on Windows, and simple chmod on Linux. Run your application (Dropbox, for example) under that user. You can use runas on Windows, and sudo -u on Linux. Please note that you might have to allow access to other folders ...


7

Under the premise that the system is so well-secured that there is only one person which can connect to it via network, then file permissions do not really matter anymore. The operating system can only enforce them against local users anyway. When an attacker can not log into the system or influence some public service running on the machine to do their ...


7

Well, you're going to have to fix your boss's "trust issues." I know of a defense contractor that removes optical drives and fills USB ports with a glue gun. Classified information is on an isolated network with no outside access. But, the real thing they do is address the "trust issues." Their employees who work with classified data must have security ...


7

Nope, and it can't exist in the general case, because you don't control the client device. This is essentially the problem that DRM solutions try to solve for video and audio content, and text or static image content is much less difficult to copy. For example, if I can see the contents of the file, I can take a screenshot of that content, run it through an ...


Only top voted, non community-wiki answers of a minimum length are eligible