Google’s Chrome OS Security Claims: Idiotic?
By Harry McCracken | Thursday, July 9, 2009 at 11:37 am
Among the things that Google says about its upcoming Chrome OS is that it’s going to shine from a security standpoint:
And as we did for the Google Chrome browser, we are going back to the basics and completely redesigning the underlying security architecture of the OS so that users don’t have to deal with viruses, malware and security updates. It should just work.
IDG News Service’s Grant Gross talked to security guru Bruce Schneier, who isn’t just skeptical about Google’s promises–he’s downright insulting:
Bruce Schneier, the chief security technology officer at BT, scoffed at Google’s promise. “It’s an idiotic claim,” Schneier wrote in an e-mail. “It was mathematically proved decades ago that it is impossible — not an engineering impossibility, not technologically impossible, but the 2+2=3 kind of impossible — to create an operating system that is immune to viruses.”
Like much of what Google has said about Chrome OS so far, its claims about security are pretty darn vague, which leaves us on the outside who try to fact-check them at a disadvantage. It doesn’t say that the OS is virus- and malware-free–just that folks “won’t have to deal with” these threats. I “don’t have to deal with” viruses and malware on my Mac in the sense that I’ve never been infected. But that’s not the same thing as the OS being invulnerable. And while Google might be confident that it’s building something that won’t ever require Windows-style constant patching, I can’t quite believe it’s saying that there are no circumstances under which Chrome OS might need a security fix, period.
We still know very little about just how much of Chrome OS and users’ data will reside on the netbook, and how much will live remotely on Google’s servers. Maybe the local OS won’t do much more than boot the computer and provide drivers and a rendering engine. Maybe all user files will be stored in the cloud. If so, it’s possible that Chrome OS will be radically safer than traditional desktop OSes.
Even so, Schneier’s surely right that it’s impossible to write an OS that’s 100.000000% impervious to viruses. As long as computing involves the fallible devices known as human beings, there’s a chance that somebody will unwittingly allow a particularly piece of software onto the system.
Here’s a way of looking at it: In the post I quote at the top of this story, Google makes reference to the Chrome browser when touting the security of Chrome OS. Chrome the browser is indeed well-done from a security standpoint, but that doesn’t mean that Google hasn’t had to patch up holes. If Chrome-the-OS is as safe as the browser, it’ll be a point in its favor. But it won’t give users a license to fall asleep at the wheel.
10 Comments
Read more:
8 Comments For This Post
2 Trackbacks For This Post
-
Chrome OS: Hacked! Says:
August 4th, 2011 at 1:29 pm[…] somebody’s finally done it. Google’s been selling us for quite a while on just how secure Chrome is, and they haven’t really lied to us. Getting into the OS or […]
-
Googles Chrome OS has been Hacked! « The 1000yr Old Man Says:
August 7th, 2011 at 9:15 am[…] somebody’s finally done it. Google’sbeen selling us for quite a while on just how secure Chrome is, and they haven’t really lied to us. Getting into the OS or the […]
July 9th, 2009 at 12:57 pm
It’s laughable. They said they’re designing a new OS based on a post-web age. Yet it’s based on an 18 year old Linux kernel. PR, PR and more PR. Surprised we didn’t get a comic book.
July 9th, 2009 at 1:20 pm
If it’s like chrome the browser then it does do updates you just don’t see them happpen. I think they are just basing the no updates claim on the fact that most people won’t be aware they are happening. They just get done by the google update service as they are released without any need to go to a windows update equivalent??
July 9th, 2009 at 1:56 pm
I actually wrote about this on my site today. Nobody knows, but it sure does sound like Google is going for a barebones OS, with the browser being the place where everything happens. If so, it might make the OS itself a bit safer, but the end user might not be safer if the browser is just as dangerous as today’s operating systems.
July 9th, 2009 at 2:33 pm
just another linux os
July 9th, 2009 at 2:56 pm
Can you have a device that consists of just a kernel and a browser? Or a device always boots by copying code from ROM? If you start with Linux, where might you wind up?
July 10th, 2009 at 5:17 am
I’d agree with Evan: according to the announcement, the ChromeOS is just the kernel (stripped down), a ‘new windowing environment’ (also presumably stripped down) and the browser. So they are just talking about the old ‘internet appliance’ but this time, they hope, done so as to sell at a cheaper price than the pc or netbook.
As to security, what about this: the OS boots off flash. There is no storage other than that flash. The OS cannot be changed unless the user presses the ‘Upgrade’ button which is analagous to flashing the BIOS on the old PC: pressing ‘Upgrade’ connects to the Goog servers and gives you the latest version of the OS.
In other words, aside from my hypothetical ‘Upgrade’ button, the OS would be like booting a diskless PC from a live Linux-CD.
How is that not secure?
Sure, a website could trick you into giving them your passwords, bank account info, and so on. But that’s not a virus, that’s a stupid user.
A version without that ‘Upgrade’ button would simply check with the Goog mothersite at every boot: in the background your OS would be scanned by Goog to ensure that it is the latest version, is configured properly, and conforms to what Goog knows it should be – i.e., it has no malware or viruses.
In this case I guess the smartbook in your lap is secure, but the Goog servers might not be. But they are not, properly speaking, part of the OS, are they?
July 14th, 2009 at 4:08 pm
Just like how most people don’t know what a browser is [1], people don’t know what an OS is either. Google Apps will be perceived as part of the OS.
Security is a lot more than just viruses, malware and security updates. At the heart it’s the computer user’s data and her integrity and reputation. Most people don’t trust putting too much in the cloud today.
The other day I wrote http://foolswisdom.com/gmail-responsible-too/ talking about one of opportunities Google has to improve in this area today.
[1] http://googlesystem.blogspot.com/2009/06/browser-is-search-engine.html
August 26th, 2010 at 2:41 am
may be you right, thanks again.