[Solved] Securing files in $HOME

Sourav · 2020-10-22 13:55:46

In GNU/Linux, if you just copy the files from .mozilla on a different machine, and then run firefox, everything you did on your main system, is copied. The worst fact is that, you are logged in into sites. All your cookies are not ecrypted.

Is there any way to secure the .config and .mozilla files so that browser data and other sensitive data are useless when copied from one system to another?

I am not looking for solutions like running gnome-keyring-daemon. I am looking for some solution where all my data on my system is unique for my system, it will be useless if copied to other systems.

Last edited by Sourav (2020-10-23 07:24:33)

schard · 2020-10-22 14:07:17

Cookies contain user data that needs to be available for certain functions such as caching and session management in web applications.
Thusly they need to be read by the respective browser. If you want to protect them from unauthorized access, encryption is the only way to achive that.
Naturally, if you copy the decryped data, it will be usable on other systems. I have the feeling that you're creating an artificial problem here.
If you don't want your broser history copied to another system, don't copy it. If it cannot be copied, it's useless anyway, since copying is just reading from target and writing to source.
So the only options to prevent that are
1) Make all other systems in the world non-writable. This is obivously impossible.
2) Make the source unreadable. Then the data itself is useless, since the browser on your local system cannot read and hence not use the data.

So you have two options:
1) Prohibit the browser from storing cookies and a history in the first place.
2) Accept cookies on your system and do not copy them onto random target systems.

Last edited by schard (2020-10-22 14:09:12)

Sourav · 2020-10-22 14:11:45

On android, you can't do that. I think rather than securing the all folders by encrypting and making the system snail paced, it's better to ask firefox for a GUID Feature:

https://bugzilla.mozilla.org/show_bug.cgi?id=1672723

Last edited by Sourav (2020-10-22 14:12:46)

schard · 2020-10-22 14:46:30

Sure you can do that on android. They're files. They can be read:
https://android.stackexchange.com/quest … in-android
https://forum.xda-developers.com/androi … e-t3376277

progandy · 2020-10-22 15:02:50

On android, you can't do that. I think rather than securing the all folders by encrypting and making the system snail paced

By the way, android by default uses encryption for user data since 2015 (android 6)

Last edited by progandy (2020-10-22 15:03:23)

schard · 2020-10-22 15:06:28

@progandy Still those files can be read an copied. The solution to OP's problem is not encryption. In fact, I'm certain that there's none.
You cannot have it both ways: Have the browser read a file and not be able to copy that file.

Also the GUID feature is not a proper solution. The key for decryption needs to be stored somewhere. If the files are to be read, they need to be decrypted with that key.
So you can still copy the key and encrypted data and decrypt it. I.e. "Who watch the watchmen?"

Last edited by schard (2020-10-22 15:09:25)

Mr.Elendig · 2020-10-22 15:18:12

Don't copy the data to machines you don't want it on in the first place.

progandy · 2020-10-22 16:11:19

schard wrote:

@progandy Still those files can be read an copied.

True, it was more meant as a counter to the slowness argument. It seemed that OP thought the android solution "better" because it is faster.

The solution to OP's problem is not encryption. In fact, I'm certain that there's none. You cannot have it both ways: Have the browser read a file and not be able to copy that file.

True, it does protect against third parties copying files from a locked computer, though.
Another partial solution could be sandboxing everything, then one application cannot read the data from another sandbox. That is another thing android is doing. Applications without any sandbox can read everything, though.

eschwartz · 2020-10-22 20:53:31

If third parties are copying your files from $HOME/.mozilla and they aren't encrypted, then literally nothing you do can ever protect them. GUID checks don't do anything, they will simply write their own program to read the files.

Sourav wrote:

I am looking for some solution where all my data on my system is unique for my system, it will be useless if copied to other systems.

The program they write will parse Firefox's open source storage format and overwrite the unique per-system info to be compatible with the system they copied it to.

At best, you'll protect against the least competent of script kiddies who tried for 7 seconds to get your data and gave up when the first thing they tried, failed.

Security through obscurity is NOT security. If you wish to make data useless if copied to other systems, you must encrypt it so it cannot be copied, or add armed guards. There is no other solution. End of story.

Case closed. Remember to edit the first post of the thread in order to add the word "[Solved]" to the thread title.

Have a nice day.

Sourav · 2020-10-23 07:21:33

Thanks. I have came up with the idea of sandboxing, what Android does actually.

The workaround is to create a user only for Firefox. We need to login to that account to open firefox. When firefox opens it will autologin, but when a newbie hacker wants to hack the system easily, he can't because the firefox folder is not executable by other users...

That's what we can also do for now. We don't need to encrypt anything, and it also doesn't reduce performance...

BTW, do you guys know that there's an NPM module that can do just the same what I wrote above? It's pretty terrific. Imagine, they have all your data, from fb details to paypal account details. The easiest way to get hacked!

schard · 2020-10-23 07:32:08

The easiest way to not get hacked is to perform a proper tradecraft analysis and secure your systems in a way that makes hacking them not worth the effort. If a "hacker" manages to get access to your browser account, they still may extract all your browsing data.

Arch Linux

#1 2020-10-22 13:55:46

[Solved] Securing files in $HOME

#2 2020-10-22 14:07:17

Re: [Solved] Securing files in $HOME

#3 2020-10-22 14:11:45

Re: [Solved] Securing files in $HOME

#4 2020-10-22 14:46:30

Re: [Solved] Securing files in $HOME

#5 2020-10-22 15:02:50

Re: [Solved] Securing files in $HOME

#6 2020-10-22 15:06:28

Re: [Solved] Securing files in $HOME

#7 2020-10-22 15:18:12

Re: [Solved] Securing files in $HOME

#8 2020-10-22 16:11:19

Re: [Solved] Securing files in $HOME

#9 2020-10-22 20:53:31

Re: [Solved] Securing files in $HOME

#10 2020-10-23 07:21:33

Re: [Solved] Securing files in $HOME

#11 2020-10-23 07:32:08

Re: [Solved] Securing files in $HOME

Board footer