You disagree about the lock-in with Google and then go on to acknowledge that one would need a Google account to login? I’m struggling to understand your logic.

I would love a streamlined Linux desktop that is as technically sound as what ChromeOS does - isolations, integral updates etc. The fact that it comes with a forced leaky pipe to Google mothership to feed their ad monster is a non-starter. We at HN should stop calling it secure*(except you know Google tracking you).

PS. I feel the same way about Windows. So, may be I’m just a grey beard yelling at the sky.

Lock-in is when you can't (or it's too difficult/expensive to) change to another platform. Requiring a Google login to access a Chromebook ain't that. You don't need to like or agree with it (it would be nice to have the option of a local-only login), but it's different to lock-in (just like privacy is different to security)

To be fair, requiring a Google Account alone isn't lock-in; lock-in would be if the OS forces you to use Google cloud services for a bunch of essential tasks, which could then make it hard to migrate to another platform.

I'll admit that I don't know for a fact that it does require this, but I just kinda assumed it might. IIRC you can run Android apps on ChromeOS, and if you buy apps from the Play store, then you're stuck with ChromeOS if you want to continue to run them. Otherwise you lose that money you paid.

> this is an OS that just runs a web browser

> You need a Google account to log in

These two sentences are contradictory, aren't they? You do not need a google account to run a web browser.

If it really was an OS that "just" ran a web browser, you would be able to run said browser without being forced to use a google account that spies on your web browsing behavior.

I'm a fan of Linux and a fan of ChromeOS. but are the user experience and security better on ChromeOS than Linux? It's a bit simpler than linux but I'd say Linux is a close second.

(Disclaimer: I work on ChromeOS at Google)

I would let anyone, even a total stranger, use my Chromebook in guest mode without a second thought (as long as I am reasonably sure they won’t steal it, break it, or disassemble it).

(Disclaimer: I also work at Google but not directly on ChromeOS.)

Exactly. I would never let my (non-tech savvy) grandparents near a Linux machine without supervision, but I wouldn't hesitate to let them near a Chromebook in guest mode.

Linux is quite secure in the hands of an experienced user. ChromeOS is secure in the hands of anyone who's not state sponsored attacker-adjacent.

It depends what you mean by “secure”. I don't count leaking data to Google as “secure”.

It's not quite the same as "guest mode" on ChromeOS, but I make user accounts (no sudo) for non-technical family members and let them use my machines unsupervised. What are you worried about here? Should I be worried?

It depends on how much you trust your family members and whether you worry about non-root malware.

Looking at my Linux machine, I notice that the default permission for home directories is 755. If I don’t think to tweak that, then I’m potentially exposing a lot of sensitive data to other users (and potentially the programs they run).

I’m a proficient Linux user but not an expert, and I’m racking my brains to think of what else might be exposed to other users on my machine.

I'm similarly racking my brain, and I came to the same finding.

755 permissions on the home directory lets others see what you have, which isn't great.

The good and bad news is, permissions on the files matter too.

SSH (private) keys for example categorically won't work outside of 600 permissions, meaning nobody else can read your private key - without escalating privileges

Now, if you go defining auth secrets in your shell profile (which is world-readable by default), probably something to reconsider.

Restricting umask is a good protection for this, for what it's worth. You can make it so that newly created files/directories are not accessible to the world

> Looking at my Linux machine, I notice that the default permission for home directories is 755.

Whoa, what? I'm running Debian, and it's 700 for me. What distro are you running? This seems like a bad choice by the distro maintainers...

> I’m racking my brains to think of what else might be exposed to other users on my machine.

Including root?

What do you think your technically inept family could actually do to your Linux system?

The permission model is such that the most damage they should be able to do, is to an account you've provided to them

Or are we assuming they get sudo and unlimited time, like the typewriter thing?

I'd be more worried handing it over to a experienced person who's familiar with rd.break, assuming the filesystem isn't encrypted

I specifically give family members Linux so I don't have to go clean hundreds of toolbars and the like, as I've had to with their Windows boxen

Would you be at all concerned about the security and privacy of your guest user’s data, given your employer’s propensity for slurping up and storing whatever user data they can get their hands on? What if your guest user was searching for terms related to abortion in a US state where that procedure is (or will shortly be) illegal? What if they’re doing that and you happen to be physically near a provider of abortions?[1]

Security does not only mean security of your own data stored on the device. A device made by Google will never be secure.

[1] https://www.politico.com/news/2022/07/18/google-data-states-...

The host operating system does not give me more or less confidence in the security of a guest user’s web browsing data.

Then you are either uninformed or willfully ignorant of 1) how operating systems and browsers work and 2) your employer's past actions relating to collecting and storing user data.

I am uninformed as to how running a Google search as a guest user on ChromeOS has different privacy implications that running that same search using another operating system.

Sure, if I carried around a privacy-centric Linux box and told my guest to use Tor browser, I could see how that could change the privacy picture. But that isn’t exactly an apples-to-apples comparison.

If you believe that having the guest user run their search on a typical Linux, Windows, or macOS machine would be better for their privacy, I would be interested to hear how.

Also, if they’re running the search in guest mode and they don’t log into a Google account, nobody can know who’s making the search. It’s not like they’re looking through the webcam or something.

Your scenario is oddly specific -- I didn't say anything about a Google search, or about ensuring that the user doesn't log in. In fact, going to www.google.com in an incognito window pops up a little animated box on the right hand side encouraging me to sign in, so I'd expect there's a good chance that my guest user _would_ sign in if they visit a Google-owned site.

> If you believe that having the guest user run their search on a typical Linux, Windows, or macOS machine would be better for their privacy, I would be interested to hear how.

The main reason is that Google controls the entire environment on a ChromeOS device (kernel, userland, browser), and ChromeOS is closed source so it's not possible for me to easily know what is going on. In addition, Google makes money by collecting data about users, so there is an incentive to collect as much information as they can get away with (and they've shown repeatedly in the past that they do just that). Maybe there's a daemon running in the background shipping URL history off to some Google endpoint in the name of "telemetry", or maybe not. Or maybe it's something more innocuous-sounding like hashed or anonymized data (which could be reconstructed given Google's immense amount of data). But I don't know, and I don't think it's reasonable for anyone to implicitly trust ChromeOS at all given the business model of the company that makes it.

On most Linux distributions, nearly everything is open source and I'm free to audit what's going on. On macOS devices, the software is closed source, but the company's business model does not involve building a dossier on each and every person on the planet, so I trust them more (not fully, but more). In the past I would have said the same about Windows, but lately I'm not so sure and I tend to put them in the same bucket as Google.

edit: Also see my reply to you in a different sub-thread where I explain this in terms of threat models. If you were building a secure OS to protect high-risk individuals like journalists reporting on intelligence leaks, you would be crazy to recommend that the journalists to use an OS built for them by the NSA, MI5, or FSB. Would you feel any better about the recommendation if the government agency said "Don't worry, as long as you use guest mode and don't sign in, we won't collect any data about you"?

I guess in practice this doesn't come up often. but it's a powerful testament to your confidence in ChromeOS' security. You are implying that you don't feel the same way about a Linux user guest login. But why? What additional security measures are present in ChromeOS that are missing from popular Linux distros?

I don't doubt the features are there, I'm genuinely curious what they are.

You can harden and configure a Linux system to have many of the ChromeOS security features, but ChromeOS has all of these enabled by default:

- All user data is encrypted at the login level. A guest user cannot access any other users’ data. Whereas in Ubuntu, for example, home directories have 755 permissions.

- The Linux userspace in ChromeOS is actually running on KVM, so ChromeOS itself is insulated from user-installed malware.

- Verified boot is huge. It is theoretically impossible for a modification to system-level software to survive a reboot. An attacker would have to modify the hardware too. And even if someone stole your Chromebook and modified the hardware to run malware, your data is still encrypted.

If you are interested, a more thorough explanation can be found here: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sec...

What if the attacker is the one who built and shipped the OS to begin with? Everything you say is true, but it doesn't matter as long as user data (history, location, etc) is being shipped off to Google.

Or, put another way: your threat model is a nefarious hacker or three-letter-agency who might secretly modify your hardware/software to get your data. Mine is surveillance capitalism. ChromeOS is secure under your threat model, but is _built by the attacker_ under mine.

Both of these threat models are important to consider, but one is much more relevant to a larger portion of the population than the other.

Relevant from your POV. A very large part of the planet clearly doesn't care.

I said it was more relevant than nefarious hackers or government agencies, not relevant in some subjective general sense. So whether or not they care is irrelevant to my point.

No they don't compare at all. ChromeOS is highly sandboxed and limited in a way desktop Linux can hardly do with normal apps.

I can't hand my non-technical family member a Linux device and expect it still work a week later without any intervention.

Do you have an example what might go wrong? I cannot imagine how can one mess up desktop Linux system without root privileges. Totally fill up the storage maybe?

They go to a shady website telling them to open a terminal and entering `sudo rm -fr /`, and you got unlucky that they entered the same password they used when logging in.

But! It's your fault! They shouldn't be able to sudo!

But that's the point. If they couldn't sudo, they could do something else as disastrous. It is difficult to secure a Linux system if the user is allowed to log in. If I needed to give someone access, I just would give him a freshly installed Linux virtual system, and if he deleted something important, it's his problem, not mine.

Without sudo privileges the worst they can do is nuke their own home directory, nothing else because that's the only path where they have write access.

Delete .config

Why would they delete files they cannot see without opting to see them ?

Because they hit ctrl+h instead of ctrl+v by accident once.

I installed Linux to a number of people, mostly over 50, some over 70. All of them but one kept using it, and the one who went back to Windows was forced because of an application he had at work whose copy protection made it impossible to run it under WINE. That was some years ago, with Linux desktop less advanced than it is now, and before the Windows GUI experience reached its lowest with Win 8 and beyond.

If you spend some time configuring the OS, Linux is actually much easier and safe to use than Windows for a series of often overlooked reasons:

1- Application installation and removal is centralized: you fire up the distribution package manager and can install almost all software, including lots of 3rd party, using the same interface; no need to wander around the net with the risk of landing on a malicious page disguised as a download site.

2- Drivers are built at kernel level and nearly all of them are already included: if you buy a new device, chances are that besides not having to insert any drivers CD, they are already included in the distribution.

3- Hardware support doesn't come with added bloatware: say, you connect the new printer and can safely ignore the accompanying CD or their manufacturer's site downloads, which usually will attempt to make you download crippled version of commercial products and other junk along the drivers. Under Linux you use the supplied applications with all hardware of that class.

etc.

Some 20 years ago I was working at a company operating in the sports betting field; we had abut 50 points of sale deployed all over the country and my assignment was to find a way to allow each remote point of sale to work in the safest possible way, no distractions and including remote support on demand. All of this of course in the cheapest possible way. The best thing about working in a small company is that sometimes you can earn the freedom of choosing the rope to hang yourself with: I'm not interested in the betting world, but that problem was intriguing, and I had carte blanche. The solution I came up with after some fiddling was a RedHat distro plus WindowMaker "desktop" with a restricted launcher whose dockapps allowed the operator to check/write emails, file for a remote support connection, open StarOffice and a couple other things I don't recall. The system was essentially in kiosk mode, with the browser set so that it would open fullscreen to operate only on the company webpage. I had to write the scripts to file for remote support since all the points of sale had dynamic IPs which could change by the time we could reach them, therefore the connection had to be the other way around. I solved this by using a remote "pinger" written in Ruby that would periodically send some data about the remote station, so we immediately had the who+where data pair, and a receiving Ruby application on our side would populate a GTK list (I used Glade and Anjuta iirc) with the stations that asked for intervention. As soon as a local operator clicked on one element, a reverse ssh tunnel was opened and we had the remote shell ready. To my memory that contraption never failed; with very slow connections (~2002, so 1 Mbit down/ 128Kbit up when we were lucky) luxuries such as VNC were out of question. 50 points of sales could be easily managed by a single operator.

Of course I'm not suggesting to turn every Linux PC in a tight closed terminal that does 3 things only. My point is that you can effectively turn a Linux desktop into something that non tech people can work without troubles, but that doesn't come out of the box, as it doesn't with Windows: you can have everything from a dumbed down terminal that couldn't be crashed by a colony of cats walking on the keyboard for a week, to something so advanced and full of knobs that you can literally do everything, including shooting yourself in the foot. Some work is needed though.

I expect that the user experience and security are better on ChromeOS. But that depends on who you're trying to secure against. I'm not particularly worried about state-level actors or even garden-variety malware. But I am worried about surveillance capitalism, and that's what Google has built its business around. So I would not trust ChromeOS to be secure against Google.

(Having said that, I still haven't been able to completely wean myself off Google services, so Google already has plenty of data on me, and gathers more every day.)

It all boils down to if what you want is an OS or a browser. If an OS is good enough feature and security wise though, there's no reason to just want the browser for the same price.

> You need a Google account to log in

This is absolutely blatany lock in, let's not sugarcoat or pretend it is not at least.

First, you can use a Chromebook in guest mode, no Google account required (as said), but they you need to log in to your accounts every time (probably not a problem for people like my mum who log in every time they use a computer, and log out of everything when they're done.

But more to the point, lock in is when you can't move your data to another system. You need a Google account to log in (these days that's not much different from Windows or Mac basically requiring MS/Mac accounts), but you don't need to use the account for anything else you do on the Chromebook; it's just a browser. If you want to, you can export any data that browser holds (passwords, bookmarks etc) and import into any other browser. That's not lock-in. Lock-in is forcing you to continue to use a particular vendor's product because getting out of it is too difficult (usually proprietary data formats ala MS Office, or not allowing cloud exports)

How is that lock-in? Lock-in to what?

Could you not access your Google account on a Linux, macOS or Windows computer?

Could you also simply not use that Google account while using those other systems?

Honestly, ChromeOS has been the best solution for my grandparents. I don't receive any calls to help them out with computer issues, which means I can spend more time with them instead of fixing stuff.

It is possible to create customised UNIX-like OS with custom kernels, read-only filesystems (mounted images) and writable directories mounted as tmpfs, booting from removable USB. Some call this "diskless". There are some drawbacks from using USB media such as lack of a good randomness source on boot but there are many advantages. Kernels and filesystems are just single files on the USB media and can be easily switched/updated. The system stays "clean". It is "like new" on every reboot. I was doing this with a netbook long before the so-called "Chromebook" came along.^1

The problem with Chromebooks is that they are designed to try to get people to "log in" to Google and to use "the [Google] cloud" for storage. Chromebooks in Guest Mode have an array of Google-authored daemons running the the background from read-only media. There is no way to disable them. You cannot even change the options passed to Chrome, e.g., to disable "Origin Trials". This setup is great if you love everything Google, but not great if you just like computers, you bought the computer for the hardware and drivers, and prefer to choose your own software. With these Google programs always running in the background, it means you do not have ultimate control over the computer, Google does. Another annoying thing is that ChromeOS, as well as Chrome, is a WIP. It is constantly changing. For example, bluetooth may be working fine and then suddenly there is an "automatic update" that breaks it. Then you wait for Google to fix it. I am not too fond of that approach to updates. For the systems I create I choose if and when to update them. I prefer stability as opposed to bleeding edge. Chromebooks OTOH assume the computer user is willingly along for the ride as the Chromebook development teams figures out what they are doing.

1. Google likes to boast about Chromebook security. Indeed the Google programs run from write-protected media, and the user is denied access to parts of the storage media, but this type of setup is nothing one could not achieve, before or after the arrival of the "Chromebook", using an open source project such as NetBSD. IMO, the benefit of the Chromebook project is the hardware support, not the deliberately limited storage, lack of user access to parts of the storage media, mandatory installation and running of Chrome and other Google programs. Additionally, one has to consider the "security" implications of an OS that steers people to use Chrome and cloud storage and to remain online. Those Google programs are constantly probing for internet access. ChromeOS is an OS that encourages risk-taking, i.e., giving more data to Google, including storing user data "in the cloud".

I always make diskless systems to be offline by default. I avoid running X11 unless needed, staying in VGA textmode by default. There is no phoning home for "updates" to an advertising company.

Chromebooks are not designed to be offline by default. ChromeOS forces users to launch a GUI and run Chrome. Google is always trying to collect more data about computer users.

https://nakedsecurity.sophos.com/2017/11/22/chromebook-explo...

You are right with many points: Chromebooks are indeed designed to be dumb terminals to Google's services. But on the other hand they have an amazing sandboxing system for all OS components and take security seriously. Compare this to most Linux distros that allow basically every local app full access to the user's account.

I wouldn't use Chrome OS as it is right now. But a degoogled version of it, maybe with some better local only support, or at least support to use a different cloud than Google's cloud, say some NAS in my home, and it would be a really nice device.

Because Chrome runs from read-only media on the Chromebook in Guest Mode, some Chrome settings (chrome://settings) are not changeable. For example, one cannot globally disable Javascript or cookies globally. It is possible to disable these "features" only using Developer Tools and therefore only on a per tab basis. Settings are lost when the tab is closed. Similarly, any changed settings in Chrome (through chrome://settings) are lost on reboot. As such, a computer user who dligently entered per site settings for privacy and security would lose all her settings every time she reboots the Chromebook.

Needless to say Chrome defaults favour Google and Google's advertiser customers. Making it impossible^1 for Chromebook users in Guest Mode to save and import privacy and security settings is a dark pattern.

1. Google employees will proclaim this is incorrect. All the computer user has to do is "log in" to Google in order to save her settings. Once logged in, Google can collect more data about the computer user. However non-employees of the corporation may not wish to "log in". Google employees assume that all computer users should trust Google, like they themselves do. Given that Google is collecting as much data about them as the law will allow, and then some, this is a curious assumption indeed.

Revised comment:

It is possible to create customised UNIX-like OS with custom kernels, read-only filesystems (mounted images), writable directories mounted as tmpfs, and encrypted disks, booting from removable USB. Some call this "diskless". There are some drawbacks from using USB media such as lack of a good randomness source on boot but there are many advantages. Kernels and filesystems are just single files on the USB media and can be easily switched/updated. The system stays "clean". It is "like new" on every reboot. I was doing this with a netbook long before the so-called "Chromebook" came along.

The problem with Chromebooks is that they are designed to try to get people to "log in" to Google, to use Google-controlled websites, to use online software controlled by Google and to use online storage managed by Google rather than local storage managed by the computer user. The later may be more convenient but it also poses higher risk for computer users while at the same conferring commercial value to Google. The company wants computer users to use its websites and software in lieu of offline storage and offline software.

Chromebooks in Guest Mode have an array of Google-authored daemons running the the background from read-only media. There is no way to control or disable them. You cannot even change the options passed to Chrome, e.g., to disable "Origin Trials". With these Google programs always running in the background, it means you do not have ultimate control over the computer, Google does.

Another annoying thing is that ChromeOS, as well as Chrome, is a work in progress. It is constantly changing and the computer user is treated as a beta tester. For example, something like Bluetooth may be working fine and then suddenly there is an "automatic update" that breaks it. Then the computer user must wait for Google to fix it. There is no way to go back to the previous working version while waiting for the fix.

One has to consider the "security" implications of an OS that steers people to use Chrome, online storage and genrally to remain online as much as possible. Google programs are constantly running on Chromebooks and probing for internet access. As such, ChromeOS is an OS that encourages risk-taking, i.e., giving more data to Google, including storing more user data online. Chromebooks are not designed to be offline by default. ChromeOS forces users to run Chrome. Google is always trying to collect more data about computer users.

I always make diskless systems to be offline by default. I use offline storage. There is no phoning home for "updates" to an advertising company. I decide when and if I want to "update" the kernel or userland.

http://nakedsecurity.sophos.com/2017/11/22/chromebook-exploi...