226

What processes and systems are in place so that Google is not able to copy the data on my computer? None. Google Chrome usually runs with the permissions of your user account. The application can then read and modify local files to the same extent your user account can. (These permissions apply to most of the programs you're using.) So you need to trust ...


99

However, after putting some thought into it I can't come up with a reason why shared executable code on an internal server shouldn't have 777 permissions. Because you're not only trusting every user - which might be reasonable on an internal server where "everybody" who has access should have that control - you're also trusting every process on that ...


85

A piece of unsandboxed software running on a PC/Mac has (generally) the same privileges as the user running it and therefore can access any data that can be accessed by the user. You are trusting Google (and any other software vendor whose code you execute) not to do anything malicious with that access. If you don't trust Google, your only option as a ...


65

Why am I getting this message? The idea of snap is to be an "app store for Linux", with much of the same benefits as app stores for other platforms, such as iOS or Android. One of the big advantages is that applications are rather confined, unable to interact with your OS unless the user gives it specific permissions. In snap, there are several different "...


48

As far as I know there is no feature like that in Adobe Reader. But even when there were such a feature, it couldn't be effective. PDF is an open format, so they could just use another PDF-capable program to view it which doesn't support this feature They could create a copy of the file before opening it. Adobe Reader couldn't know about that second copy, ...


38

If you are running a Linux distribution with SELinux, it is possible to have an additional layer of security. SELinux is an OS-level technology which allows tight restrictions on what processes — like your browser process — can access. In fact, in Fedora and in Red Hat Enterprise Linux (disclaimer: I work for Red Hat, on Fedora!), there is a light ...


30

There is a way to distribute the risk such that any single print-shop gains no benefit from copying your files: Visual Cryptography. But it is esoteric and it is hard-core - versus simply buying your own printer or eBook reader. To print PDFs at untrusted print-shops with visual cryptography, you use special software to split each page into two parts - ...


29

A call to fopen is not in itself a TOCTOU vulnerability. By definition, TOCTOU involves two operations: a “check” and a “use”. A common example of TOCTOU vulnerability is checking access permissions with access before opening a file. It's a bug (race condition) because the permissions might change between checking and opening, and it's usually a ...


26

I'm gonna second @gowenfawr and say that breeding better chimpanzees is a goal unto itself here. (now I will extrapolate wildly about your corporate culture) At my software development company, we've been seeing an increasing trend of customers asking for evidence of our security practices not just in production environments, but also in our development ...


23

Lawyers. You have a contract with Google stating what they will do / you allow them to do. This is called the Google Chrome Terms of Service . And obviously, you have carefully read it before installing it. This includes¹ excerpts like this (emphasis by me): By default, usage statistics and crash reports are sent to Google (…). Usage statistics contain ...


21

Why there are not already more anti-crypto-ransomware tools? Because there are. They are called virus scanners and they should have heuristic algorithms to detect this behavior. Unfortunately the ransomware-developers are smart enough to test their creations against all commonly used virus scanners and make sure they circumvent their heuristics somehow. ...


20

There's no technical way to solve this. The file (or, rather, a version of it) will be stored in the computer's cache for some time, and sent to the printer which will keep it there for some time. There are several places where a version of your file can be intercepted and stored. If you don't trust the copy shop, get your own printer.


18

What processes and systems are in place so that Google is not able to copy the data on my computer? There's not anything in place that makes it so they can't but there's something in place that makes it unlikely that they would: trust. Google's product is you. They want to know everything about you and be able to predict every single decision that you will ...


15

It’s like this comic: Generally, any program that runs under your account can access any resources that your account can access. Can Skype really scan anything I have in my home directory regardless of the permissions set to files and directories?  Does it become like a sort of superuser? As stated in MechMK1’s answer, no, it does not become more ...


11

I faced similar problems. I solved it by following these steps Right click on hosts file go to properties. Go to the Security tab. Under Groups and users go to the System and edit permissions. Deny write permissions for the System. Press OK and Done.


11

The concept is that on a given "object" (say, a file), you have access permissions which detail who can access the object and under which conditions. The owner is an optimization: usually, among all the users who have permissions for a given object, one of them should have "all the permissions" and be generally considered as responsible for this object. On ...


9

It is possible to make one-way Ethernet cables. This site has lots of pointers to various documentations for that. Note that things change depending on whether you are doing 10 MBits/s, 100 MBits/s or 1 Gbits/s (10 MBits/s is easy: simply cut off one pair; 100 MBit/s is tricky; gigabit seems infeasible since the signal uses phase modulation over all eight ...


8

Jpeg files can contain Exif data, which can include a thumbnail. Theoretically, it seems it would be possible to store more than one, but I don't know of any program that does it, nor of a program that would read it. What is likely to have happened in your case is that the program you used to crop the image modified only the main image, without modifying ...


8

Your suggestion is interesting; unfortunately a generic solution is not possible as there is no combination of bits that would cause an encryption algorithm to "stall". Encryption is just math, after all. Perhaps use of a rootkit could trick ransomware into believing that it's encrypting a fake yottabyte-long dummy file handle, or it could have delays ...


7

Under the premise that the system is so well-secured that there is only one person which can connect to it via network, then file permissions do not really matter anymore. The operating system can only enforce them against local users anyway. When an attacker can not log into the system or influence some public service running on the machine to do their ...


7

Create a new user. Give that user access rights to only the folders you want to share. You can use the File and Folder Permission options on Windows, and simple chmod on Linux. Run your application (Dropbox, for example) under that user. You can use runas on Windows, and sudo -u on Linux. Please note that you might have to allow access to other folders ...


7

Well, you're going to have to fix your boss's "trust issues." I know of a defense contractor that removes optical drives and fills USB ports with a glue gun. Classified information is on an isolated network with no outside access. But, the real thing they do is address the "trust issues." Their employees who work with classified data must have security ...


7

Nope, and it can't exist in the general case, because you don't control the client device. This is essentially the problem that DRM solutions try to solve for video and audio content, and text or static image content is much less difficult to copy. For example, if I can see the contents of the file, I can take a screenshot of that content, run it through an ...


7

Unless the program requires write permissions, I am confused as to why your coworker used chmod -R 777 /opt/path/to/shared/folder when chmod -R 775 /opt/path/to/shared/folder would still allow read and execute permissions, and achieve the desired access. Given your team members are the only ones with access to the server, and you trust them. Having global ...


6

Is there any (security) reason behind for having it that way? Yes - a type of Security through obscurity - the files aren't really secure as the URLs are available without authentication, but it would make them reasonably private as they are not guessable. You would need more information (such as browser history logs) or some kind of brute force that would ...


6

Remember that TCP/IP requires 2-way communication. Yes, someone can spoof an IP (with difficulty), but in doing so, they break the ability to receive replies. Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS.


6

In general, yes, booting from a flash drive gives you access to anything that's not encrypted. In this specific case, Tails itself is stopping you. It's voluntarily respecting the permissions declared by the filesystem on the hard disk. This isn't intended to prevent you accessing private files though - it's simply a side effect of the fact that Tails, for ...


6

Extending off of Arminius's answer, which is completely true, I would like to make it very clear that the value of trust between Google and the end users is not the only effective value in determining whether your trust in their integrity is fair. Chrome's base (Chromium) is open-source, so developers can check on that (and do all the time) to see whether ...


5

One solution is to forbid access to the folder where the sensitive files are stored, so that it is not possible to access them directly. For example, place these files under http://siteis.com/secured_uploaded_files/ and place a .htaccess file there (for apache) to prevent access. You can also place the files outside the web server's document root. Step two ...


Only top voted, non community-wiki answers of a minimum length are eligible