Most of the surveillance stories we’ve looked at here lately have involved things you can at least see when you walk past them: cameras at the gate, sensors on the shelf, a label adjusting a price as you move through space.
So ifI run a hardened Firefox inside a docker container and spoof any identifying information and run no other tabs or programs, will that limit exposure?
Probably not. AFAIK docker isn’t a virtual machine in the traditional sense that it has its reserved storage other apps on the machine can’t access. And even if it were, it’s the same physical drive.
Now I’m not too versed myself in SSD firmware so maybe the large file size really is like a wide net, or maybe the file size isn’t important - only the fact you’re doing read operations on a small space on the SSD may give enough volatility in the read speed to infer the exact app that decided to spin up at that moment.
The simplest fix that comes to mind is to have multiple drives (e.g. install and data) and put the browser on the data one. Maybe this added complexity can throw off some naive attacks. Also, a HDD “naturally” has some variability in the access time (since it needs to physically locate the sector with its read heads).
So in essence, laptops with a single SSD are by far the most vulnerable.
However, adding sane limits on the vulnerable API mentioned and throttling read/write speeds (ideally with randomization) seems like a fix good even for single-drive laptops.
What’d probably work with Docker is a similar read speed throttling setup.
Spoofing identifying information won’t help much since read time variability is what matters here. It may make it take more info to infer performance rather than having the transparent information, but a good model is bound to infer pretty well after some initial data.
Sounds like portainer with extra steps, but if it works for you, cool. As said I prefer podman, but I’m on an immutable fedora derivative, so it’s natural.
So ifI run a hardened Firefox inside a docker container and spoof any identifying information and run no other tabs or programs, will that limit exposure?
Probably not. AFAIK docker isn’t a virtual machine in the traditional sense that it has its reserved storage other apps on the machine can’t access. And even if it were, it’s the same physical drive.
Now I’m not too versed myself in SSD firmware so maybe the large file size really is like a wide net, or maybe the file size isn’t important - only the fact you’re doing read operations on a small space on the SSD may give enough volatility in the read speed to infer the exact app that decided to spin up at that moment.
The simplest fix that comes to mind is to have multiple drives (e.g. install and data) and put the browser on the data one. Maybe this added complexity can throw off some naive attacks. Also, a HDD “naturally” has some variability in the access time (since it needs to physically locate the sector with its read heads).
So in essence, laptops with a single SSD are by far the most vulnerable.
However, adding sane limits on the vulnerable API mentioned and throttling read/write speeds (ideally with randomization) seems like a fix good even for single-drive laptops.
What’d probably work with Docker is a similar read speed throttling setup.
Spoofing identifying information won’t help much since read time variability is what matters here. It may make it take more info to infer performance rather than having the transparent information, but a good model is bound to infer pretty well after some initial data.
Well, probably. Do you?
Thinking about it. I have docker running for other local homeland services.
Look into podman / docker as user (may as well go podman, you get SELinux for free)
I used dockge to manage images and instances.
As long as it’s not basic root docker, the gaping hole in self-hosted security. I don’t know that, why is it good?
It’s a lightweight open source web based manager.
You can manage images and edit docker compose files and see terminal output from one place.
Makes it easy to see everything and is very functional.
https://github.com/louislam/dockge
Sounds like portainer with extra steps, but if it works for you, cool. As said I prefer podman, but I’m on an immutable fedora derivative, so it’s natural.
I didn’t like portainer. I think it works with podman.