Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just read an article where I came across this little bit :

The sites you visit still exist on your computer, even after you delete your history and make every effort to keep everything private. A skilled computer technician could find your browsing history. Only a complete system install will wipe it away.

Now I was wondering, if I install my browser inside a truecrypt container or on a virtual machine, is my browsing history still stored somewhere else? Is there absolutely no way of hiding it, even for the smartest technician?

share|improve this question

closed as not constructive by Breakthrough, nerdwaller, Ƭᴇcʜιᴇ007, Dave M, Nifle Jun 7 '13 at 20:31

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

3  
If you're concerned about the traces of your browsing history in your OS, and given some interesting challenges in preventing them, why not just use full disk encryption on your whole OS install? Would that not significantly simplify the work to secure it, be easier, and provide additional security benefits (outside of your browser)? –  krondor Jun 3 '13 at 22:30
    
Would be a very effective option, but also very obvious and I'm trying to keep it innocent and deniable (: –  freek Jun 3 '13 at 23:12

1 Answer 1

up vote 4 down vote accepted

The real answer is, it depends on the program itself, and how it's written (e.g. when does it move data to disk after being in RAM? What cache replacement policies does it use? How does the history clearing mechanism work?)

The only tired-and true ways to do this are (in preferred order):

  1. force the browser to store all temporary data in RAM as opposed to the hard drive (e.g. disable disk cache and enable/force the use of a RAM cache *)
  2. use a sandbox (e.g. Sandboxie)
  3. use a Virtual Machine (e.g. VirtualBox)

Note that just avoiding writing to disk is the most preferred secure option (it would be the fastest and ensure no sensitive data ever gets written on an HDD/SSD), but the least portable. For the ultimate portability, a virtual machine might be best (as many virtual machine programs are cross-platform), but a common and very feasible option less setup to configure for a correct, secure operation.

* even data stored in RAM can be recovered (see cold-boot attacks), although this requires physical access to the machine and is very time sensitive given the operation of dynamic RAM.


As a final word, I wouldn't really worry about the browsing history stored on the computer. It only really matters if someone has physical access to the machine, and even if that were the case, there's many things you can do to protect yourself.

I would be significantly more concerned about your internet usage being monitored at the access point. In the latter case, there's absolutely nothing you can do besides ensuring your traffic never passes through the access point monitoring your traffic (e.g. ensure the use of secure HTTP, or preferably, use a different network).

share|improve this answer
    
Thanks for the very fast reply! Is option 1 even possible with mainstream browsers like chrome or firefox? I prefer one of those because of some plugins. –  freek Jun 3 '13 at 22:21
    
Perfect. I would also say that even a program that does follow through with its deletion policies does not necessarily permanently destroy data. A HDD data is recoverable up to the 7/8th time it is overwritten. For full details on data recovery from a wiped HDD see Department of Defense policies on highly classified data disposal. Edit: Yes, it is possible. See lifehacker.com/5730541/… –  Will.Beninger Jun 3 '13 at 22:22
    
@freek indeed there is. I use that setup on my computers which have SSDs to prevent excessive drive writes. I don't know the exact config variables off-hand, but here's a quick & easy guide I found to enable RAM caching and disable disk caching in Firefox. –  Breakthrough Jun 3 '13 at 22:24
    
@Breakthrough +1, and like you said it depends definitely on the program, but also on the OS, and even the hardware. Even option 1.) has shown data is recoverable even offline, albeit with Herculean effort. –  krondor Jun 3 '13 at 22:25
2  
@krondor indeed you are correct, answer updated. Note that this type of attack is called a cold-boot attack, and while it is certainly possible, it does require physical access to the machine (although a compromised computer may allow full disk access, the operating system may still prevent full access to the entire system's memory map). –  Breakthrough Jun 3 '13 at 22:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.