After watching a talk by Douglas Crockford on security where he talks about how browsers got the right answer to the question "Who's interest does the program represent?", I wondered if it was feasible and a good idea to run some programs as another user.
I'm running Debian but I guess this could apply to any OS.
I tend to trust anything coming from the stable, backports and testing repositories (please tell me if I shouldn't) but whenever I install something else, something that isn't on these repositories, I don't really trust it. And I have quite a few of those from Mathematics programs such as Maple to browsers such as Chrome to games such as Heroes of Newerth.
Since that makes me unable to trust my own OS, I boot on a live CD every single time I want to use my credit card.
So I was wondering if just running those programs as a specific user could be of any help. I'm fine with Chrome being able to see everything I do online but that's where it must stop. I'm fine with Heroes of Newerth seeing what mods I installed, updating its files and so on but I don't want it to be able to access the browser's cache or anything else.
From my understanding of how this works, I'd be able to run each not-totally-trusted program as a separate user, giving them the read and write access to only the files they need.
Is this feasible (like, will I be able to still control volume and other per-user things?)? And will it add the kind of security I want?
Thank you in advance for your answers.
P.S.: I've already found this: Execution of possibly harmful program on Linux
But a virtual machine won't work for video games, I'm already doing the live CD thing but it's kind of annoying, the chroot thing seems overly complicated since I'd need to get the libraries etc. and the sandbox is just an upgraded chroot. And he says using users is useless because the files can be accessed if you don't set the proper rights. But I can just remove read access to anyone but me, can't I?