It feels so many security ideas fail to protect the /home dir which contains 99% of important data that needs secured, and instead focus on the OS. I understand that for servers and hypervisors, but it feels like so little effort goes into desktop OS on this.
Basically, desktop OSes need to become more like iOS and Android in how they ask for permissions and segregate apps from each other.
Note: I like that it does that and would like this capability to be expanded and refined.
Eg a warning/prompt if a program tries to read/modify/delete more than x files in your home directory (not including its own config files). This would stop an entire class of malware scanning for passwords or secrets in your home folder. It could even if implemented right stop some of the ransomware attacks after a few files.
It seems crazy that so little effort is put into this kind of thing vs the crazy level of effort that goes into hardening the OS.
But considering immutable OS increases overall security of the system and that the system/software likely has to be compramised first to tamper /home/* I think they're useful to prevent this attack as well.
[1] https://needgap.com/problems/188-proving-computer-hack-proof... (Disclosure: I run this problem validation forum).
What really helps is application sandboxing, e.g. with firejail.
How is this solved?