Slashdot Mirror
Security Experts See Chromebooks as a Closed Ecosystem That Improves Security (cnet.com)
The founder of Rendition Security believes his daughter "is more safe on a Chromebook than a Windows laptop," and he's not the only one. CNET's staff reporter argues that Google's push for simplicity, speed, and security "ended up playing off each other." mspohr shared this article:
Heading to my first security conference last year, I expected to see a tricked-out laptop running on a virtual machine with a private network and security USB keys sticking out -- perhaps something out of a scene from "Mr. Robot." That's not what I got. Everywhere I went I'd see small groups of people carrying Chromebooks, and they'd tell me that when heading into unknown territory it was their travel device... "If you want prehardened security, then Chromebooks are it," said Kenneth White, director of the Open Crypto Audit Project. "Not because they're Google, but because Chrome OS was developed for years and it explicitly had web security as a core design principle...." Drewry and Liu focused on four key features for the Chromebook that have been available ever since the first iteration in 2010: sandboxing, verified boots, power washing and quick updates. These provided security features that made it much harder for malware to pass through, while providing a quick fix-it button if it ever did.
That's not to say Chrome OS is impervious to malware. Cybercriminals have figured out loopholes through Chrome's extensions, like when 37,000 devices were hit by the fake version of AdBlock Plus. Malicious Android apps have also been able to sneak through the Play Store. But Chrome OS users mostly avoided massive cyberattack campaigns like getting locked up with ransomware or hijacked to become part of a botnet. Major security flaws for Chrome OS, like ones that would give an attacker complete control, are so rare that Google offers rewards up to $200,000 to anyone who can hack the system.
The article argues that "Fewer software choices mean limited options for hackers. Those are some of the benefits that have led security researchers to warm up to the laptops...
"Chrome OS takes an approach to security that's similar to the one Apple takes with iOS and its closed ecosystem."
That's not to say Chrome OS is impervious to malware. Cybercriminals have figured out loopholes through Chrome's extensions, like when 37,000 devices were hit by the fake version of AdBlock Plus. Malicious Android apps have also been able to sneak through the Play Store. But Chrome OS users mostly avoided massive cyberattack campaigns like getting locked up with ransomware or hijacked to become part of a botnet. Major security flaws for Chrome OS, like ones that would give an attacker complete control, are so rare that Google offers rewards up to $200,000 to anyone who can hack the system.
The article argues that "Fewer software choices mean limited options for hackers. Those are some of the benefits that have led security researchers to warm up to the laptops...
"Chrome OS takes an approach to security that's similar to the one Apple takes with iOS and its closed ecosystem."
Linux for the win!
Everything from Google, a giant advertising company that wants to track your every move. Fools.
VERY secure.
... an oxymoron.
It little behooves the best of us to comment on the rest of us.
would be just as good as long as it is in competent hands
Politics is Treachery, Religion is Brainwashing
I can see why one would purchase a cheap laptop with Chrome OS for their children in middle school or high school but once they are college bound only a quality laptop that is neither repairable nor upgradable running macOS with 10 dongles will do.
- Tim in Cupertino
First let me establish to what extent I am qualified or not to address this question:
I've been a security professional for 20 years. Most of that time I used Linux exclusively. Recently I've also started using Mac. You'll find my name in the kernel change log.
There are three main areas of security; confidentially, integrity, and availability. Most of the time when people say "security" they mean confidentially first, with some thought to integrity, and they rarely think of availability. For confidentiality and integrity, the top two things an OS can do to help is limit the attack surface (such as not running unnecessary daemons or other software) and provide quick, reliable updates. The only code that can't possibly be hacked is code that isn't there, so the most secure system is the most minimal system. Real-life attacks use known vulnerabilities 99.99% of the time, so quick, automatic updates to resolve known issues are very important.
There is one Linux distribution that stands out for avoiding any unnecessary code (and potential vulnerabilities) and providing quick, reliable updates. That distribution is ChromeOS. It's well ahead of the others. It would be rather difficult indeed to set up a general-purpose distribution such as Ubuntu, which is made to support servers of all kinds, all kinds of workstations, etc, to be as secure as Chrome OS.
The third leg of security is availability. If the features and functions you need aren't available on ChromeOS, it won't work for you. Normally we think of availability as "not subject to denial of service or random crashes", but if the service you need is denied by the creator of the OS, that has the same effect as a denial of service attack.
ChromeOS is therefore well ahead of any general-purpose OS in terms of security - for users who don't need anything ChromeOS doesn't provide. That's a LOT of people. It even suits my needs while traveling because my travel device only needs to SSH to my main machines, and provide a web browser.
The Chromebook isn't a full blown laptop that can run all sorts of high end software.
True, but it did crowd more versatile compact laptops out of the market. To what extent did the introduction of the Chromebook in third quarter 2011 cause inexpensive compact laptops to cease being a market segment at the end of 2012?
The real version of AdBlock Plus has been malware since they started deciding some ads were acceptable for the end user.
If you oppose all web advertisements, would you prefer having to pay $5 for each distinct domain that you visit in a month? That'd make web search engines a lot less convenient. If you have a third option in mind other than ads or paywalls, I'd be interested to read it.
No mention of how much is leaked to google: copies of your files sent there or other metrics that google might sniff. But if you are happy with that then yes it is secure.
Sure, I'll agree with summary. A closed system is inherently harder to hack. And harder to put malware onto if the model is excluding unsigned/unapproved code.
But is this something we really want? We've heard that 'they' would like general purpose computing to be revoked from the general population, or at least severely limited.
This is a step in that direction, under the guise of 'It's more secure!', yeah, it's also locked down and useless for any function other than it's designated function. I'm not really interested in this. I don't think it's a good idea to be pushing this kind of solution.
It's a nice looking 'gift', but it's trojan horse. A trojan to train the population that they don't need general purpose computing, and that general purpose open computing is dangerous and unsafe. Not good.
Indeed, chromeos may be a closed system in its default configuration, but its still open source and its success actually provides significant benefits to those of us who want to use regular linux distros...
You used to get websites which check your user agent string and reject anything which is not windows or macos, such things are less common these days thanks to mobile and chromeos...
Manufacturers shipping devices with chromeos ensures that the hardware is compatible with chromeos, and thus also with linux. The same hardware can also usually be bought in other models of devices. Previously most non-server hardware was never tested with linux and could have all kinds of stupid compatibility problems.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Your school system is habituating people to crippled, minimal devices - the very poster child for dumbing down the students.
Chromebooks are only a good answer to going backwards.
Unfortunately, going backwards is a trend that is taking over all of society.
Over the last 30 years, computers have become more and more powerful, hard drives and monitors have become bigger and cheaper, and yet today most people spend all their time staring at a phone with a 5 inch screen and the power and storage of an early 90s era PC.
Micropayments.
I visit your web page and stay for more than ten seconds, you get a penny.
I'm be totally for this rather than ads or site-specific paywalls or being data-mined.
I've fallen off your lawn, and I can't get up.
Someone accidentally wiping your developer-mode Chromebook is a valid concern. But you can reflash the firmware with something like MrChromebox's Firmware Utility Script to prevent that. I did that on the Acer 15" Chromebook I am using to write this post. It now runs GalliumOS (based on Xubuntu) and applications like Visual Studio Code and Minecraft. See: https://wiki.galliumos.org/Ins...
I did replace the flash memory with a 128GB module -- but that isn't strictly necessary. More details on all that in my comments here: https://news.ycombinator.com/i...
For under $400 total with the new drive plus some of my time, I am happy with it as my main personal machine these days for web browsing and some FOSS development. A centered trackpad with a 15" screen is otherwise a hard combination to find at the low end since so many companies add a numeric pad and offset the trackpad for terrible in-lap ergonomics. It's obviously not a MacBook Pro (which I use in my day job), and I do miss a backlit keyboard and a retina display, but it is a heck of a lot cheaper.
Probably the biggest limitation is you can't run Windows-only games or anything requiring intensive graphics processing. Steam's remote streaming from a desktop does work but is laggy.
It is also true that if you update the firmware you are out of the Google security ecosystem -- with both good and bad implications. So for the casual user, plain ChromeOS is probably a better choice (ignoring Google privacy issues). And web services like Cloud9 IDE can do a lot. And many of the latest Chrombooks can run Android apps.
And I can see why security professionals going to conferences would prefer the stock ChromeOS firmware and being able to powerwash back to a known good install -- with their data is stored elsewhere on the network.
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
To be fair, that's all the power the average person actually needs. For many years they were forced to use huge beige boxes that sucked 200 watts because that's what the average geek was using. It helped drive down the cost of our hardware, but ordinary people still hated using them.
Now that computers are mainstream and commodity items, the tides have turned. Geeks are being forced to use tablets and phones, and it's likely that out beloved desktops will shortly return to workstation price ranges due to lower sales volumes and encroaching walled gardens. Sucks, doesn't it?