Printable View
*deactivates lurking mode*
Recently a frien of mine convinced me to start using FireFox it's a nice browser and the fact that its got some features IE does not made me keep using it but.
I was wondering how much more or less secure FireFox is compared to IE.
And while we are at it what would be the most secure browser available ?
Just like operating systems.................nothing is "secure" per se....................depends how you set it up, how you use it etc..........
Anything other than IE is more secure in theory, because IE is the most common browser and therefore, the most targetted?
Cheers
To be very straight foward:
1. Firefox has automagic popup blocking, eliminating the accidental click.
2. Firefox has ActiveX disabled and not installed, to get away from the annoying spyware that can be installed at the touch of a button.
3. And finally, the way Firefox handles URLs, HTML rendering, and the like is done in such a way that the code base is natrually more secure than IE. Whereas the URL reading in IE allows vunerabities for spoofing and the like, Firefox has already noticed the mistakes IE has made and placed much more solid code in there.
Granted, if IE had never made these mistakes, Firefox might have made them. But, none the less, there is the rundown to your question.
Hi
Firefox has emerged as a real contender to pick up the browser wars from where Netscape fell. But what is About IE that makes it Such Sucessful , Well My answer would be on Windows, IE remains the default because other applications rely on it. Ypou Simply can't get Rid of it and also end users rarely change the defaults. The uncomfortable truth is that IE, for all its shortcomings, is a quality product.
Because its Popularity it also becomes like Microsoft's OS, Target of Most of the Hijak Attacks. Well to tell you the truth i never had a problem of home page hijak in Firefox. And My IE Home page got hijacked every 6to8 days.
Firefox does well in the areas that really matter usability, extensibility and security. To put another way what Internet Explorer gets wrong, Firefox gets right and i love it
The first thing that struck me about FireFox was Simple, Uncomplicated. IE is Very unforgiving to Badly formatted HTML, on the other hand Firefox is quite opposite
Initial startup of Firefox is slower than IE can't blame it though Most of IE Shared libraries gets loded in the memory as the Stystem gets Booted.
Firefox doesn't offer ActiveX support. This can be seen as an advantage, because it immediately eliminates a whole host of exploits to which IE is vulnerable. Somehow it hasen't affectd it's popularity a bit i never felt the lack of it but certainly feelt safer.
And its Open Source need i say more on it ..........................................
The fact that Firefox isn't tightly integrated into the underlying Operating System like IE , This might be a advantage security-wise.
Thats it for now , I am a bit Drunk right now...... See you later
EDIT
Where did you two come from Soorry Your posts weren't there when i started writing mine *hic *HIC
--Good Luck--
I actually like that aspect of IE. It encourages people to write proper HTML code that works instead of half-assed code :)Quote:
IE is Very unforgiving to Badly formatted HTML,
hi Poo
The coin always has two side , Every Advantage can be a disadvantage at other time for example ActiveX corporate users might not prefer Firefox coz if they have to use intranet apps that generally rely hevaly on ActiveX . IE would be a better option then
--Good Luck--
So install the ActiveX plugin for Firefox :)
IE is the most secure web browsing solution (not client) availible for windows.
By running IE as a less privileged user and locking it down (with regard to scripts and the like) IE will be safe to browse with.
The reason why it is more secure than other locked down browsers run as a less privileged user is that since you can't remove IE you've up the system's complexity by adding the second browser. Giving the entire system less assurance, in pracitcal terms it means that many expolits will be able to target the application they wish and this means that your new browser and IE are valid targets. (This however does not include browsing exlpoits, but since comparing those merely comes down to a conversation about bug counts as most browsers offer the same types of security mechanism there really is no point.)
catch
So, basically turning it into another browser? -hands you a tin foil hat-Quote:
By running IE as a less privileged user and locking it down (with regard to scripts and the like) IE will be safe to browse with.
Quote:
Originally posted here by pooh sun tzu
So, basically turning it into another browser? -hands you a tin foil hat-
How is this turning it into a different browser? Those lock down options are part of IE for a reason.
catch
It isn't just about settings, which is what my first post here talked about. Sure, you can alter IE settings to make it as secure as a Mozilla source build. Sure you can add a google bar to block popups. But then again... FireFox, Mozilla, and Netscape already have these features by default.
But the greatest threat is the base source code within IE itself. That is unchangeable, unpreventable, and unblockable. Settings won't alter a thing in the world when a buffer exploit in URL handling exists. Thus what I said in my first post on this thread. IE still remains insecure for it's natrual codebase exploitation.
Ok... let's try this again
Web browsers face two types of attacks:
1. Arbitrary code execution
2. spoofing and other contained exploits
#1 is defeated by running the browser via a less privileged user, such as a guest account. #2 is defeated by by proper configuration, and again simple security math tells us that it is better for a system to be issued in as unhardened of a state as possible so that once it's final configuration has been determined hardening can ensure more complete coverage using the fewest resources.
Now #1 is completely defeated, #2 is an area that is still likely to effect the browser, any browser in fact, but to a greatly reduced extent if the browser is locked down.
All this being said there is no advantage to IE over anything else with regard to security, unless you want to make a discussion about development maturity models and I don't think you do.
Now the weakness, any Windows system is still going to have IE on it, so any local exploits or other non-browsing issues can still target it as well as your new browser of choice. This means that with regard to this type of attack your security is actually less by running a second browser. Consequently using only IE is more secure.
catch
Disagreed, from more experience than I care to argue about right now.
If you are not going to defend or explain why you think something, why should anyone here care?
Basically you've just replied with "nuh-uh!"
catch
PS. "experience" = anecdotal evidence, which really has no place in a technical discussion.
Fine, you want to get snotty? Let's get snotty. I'll take the trollbait.
1. Running anything on a guest level still requires systemwide DLL acess for IE to function. Thus, on a guest level system specific DLL's are still called upon in code functions. Their access to read/write is not controlled per system application but by user login. Running IE at guest privleges would not only HINDER everyday usage, but prove uneventuful in halting exploitating of code, URLs, and exploitation of built in IE components.
2. Settings are settings. If you wanted default secure settings, you should have used a different browser.
3. If IE is not running (and preloaded DLL's do not count) then IE will not be exploited. If a second browser is installed then the second browser alone is prone to exploits, and not to an exe that is not running. Memory footprint of the dll's loaded for IE are not just IE only DLL's and are thus system wide DLL's. Thus it is not the browser but the DLL's the system uses to tie multiple applications into. Whether you use one browser or two, the risk is not elevated.
4. Being OpenSource, FireFox has the uncanny ability to learn from the competetors mistakes, namely IE. This means responce time for patches and fixing are incredibly fast for any OS release, including Windows. So while you run a crippled version of IE, Firefox will still be fully functional and secured because of it's default code base.
5. You can change all the settings you want, but you can not alter embedded code within a closed source project, making IE still vunerable.
[QUOTE] Originally posted here by pooh sun tzu
Fine, you want to get snotty? Let's get snotty. I'll take the trollbait.[/qiote]
Take it however you like, by just stating that you disagree with no reason ads no value to the conversation. I gather by your more complete response my being "snotty" helped you see the light... so it's all good. ;)
I am not sure what you are saying here, how does running IE under the guest user not use the login information? If you find some way to have an application's DLLs not be limited to the user account it is running under... well you should publish that because you will have completely broken Windows security. Outside of that... I cannot think of any functionality issues this would prevent with the possible exception of not being able to save webpages to directories lacking guest access, which is easily dealt with.Quote:
1. Running anything on a guest level still requires systemwide DLL acess for IE to function. Thus, on a guest level system specific DLL's are still called upon in code functions. Their access to read/write is not controlled per system application but by user login. Running IE at guest privleges would not only HINDER everyday usage, but prove uneventuful in halting exploitating of code, URLs, and exploitation of built in IE components.
Why are you hung up on the settings being default? The settings should be such that they fit most appropriately within the system. Locking a system down (hardening) has more easily calculated consequences than disabling security features, this is why high security systems ship in a completely unhardened state and provide a TFM for the system owners/custodians to harden as appropriate. The fact is IE has the functionality to be locked down, default or not is unimportant.Quote:
2. Settings are settings. If you wanted default secure settings, you should have used a different browser.
So... a local attacker or exploit (that perhaps effects another application and then manipulates IE) can't use IE? I am sure you don't think this.Quote:
3. If IE is not running (and preloaded DLL's do not count) then IE will not be exploited. If a second browser is installed then the second browser alone is prone to exploits, and not to an exe that is not running. Memory footprint of the dll's loaded for IE are not just IE only DLL's and are thus system wide DLL's. Thus it is not the browser but the DLL's the system uses to tie multiple applications into. Whether you use one browser or two, the risk is not elevated.
Ah the open source argument... did you know that the average lifespan of a Linux source level bug is nearly 2 years. Woo "incredibly fast"... no doubt. (I'll send you my documentation from the Stanford CSL if you doubt this fact) Open source is an inferior development model, (stage 1 on http://www.sei.cmu.edu/cmm/cmm.html )Quote:
4. Being OpenSource, FireFox has the uncanny ability to learn from the competetors mistakes, namely IE. This means responce time for patches and fixing are incredibly fast for any OS release, including Windows. So while you run a crippled version of IE, Firefox will still be fully functional and secured because of it's default code base.
Ok, you hate closed source, we get it. Also just so you know in a closed source product, the code isn't "embedded" it is just "code." In computer science "embedded" means to put something within something different... like compiled SQL being embedded into a C++ build. Not just C++ embedded within C++.Quote:
5. You can change all the settings you want, but you can not alter embedded code within a closed source project, making IE still vunerable.
There is no reason to alter the IE source, I already explained how the two types of browsing threats it faces can be defeated, the only remaining issue is the effect it has on overall security... wherein the computer security universal truth of simplicity prevails and having two browsers is less secure than one.
catch
This is not worth my time. You are not here to discuss, just argue. Good day to you. I throw in my gloves for the sake of this thread. IF you want to continue to be an ass, PM me and we can continue there.
Well there are more replies here then I thougt. I believe that's a good thing right ?
So far this is it:
FireFox:
Opensource
No directX disbled
Less targeted
PopupBlock
Correct's errors in html and url's ?(thats what i understood)
More secure codebase(???)
(you can also disable javascipt and java)
Slower loading
IE:
Closedsource
DirectX enabled
Less secure codebase(?????)
Targeted more
Strict in formating HTML
Faster loading
Warn me if I mis anything.
If that is true won't firefox get less secure when it gets more popular ?Quote:
Anything other than IE is more secure in theory, because IE is the most common browser and therefore, the most targetted?
eeuh.......... I don't really get the part of the codebase.Quote:
And finally, the way Firefox handles URLs, HTML rendering, and the like is done in such a way that the code base is natrually more secure than IE.
I like that to programming wether it is C++ or HTML or JAVA should be done proper.Quote:
I actually like that aspect of IE. It encourages people to write proper HTML code that works instead of half-assed code
That's a good thing right. If all of FireFox's libraries and stuff still have to ge loaded it means that it doesn't use stuff that is intgrated into windows. That makes it more secure.Quote:
Initial startup of Firefox is slower than IE can't blame it though Most of IE Shared libraries gets loaded in the memory as the Stystem gets Booted.
Does having a second browser installed make my system less secure. Or am i yust reading this wrong. Also when running as a normal user I get the same problems as while running as admin in IE. Or do you wan't me to use the guest account for real because I kind of disabled that.Quote:
The reason why it is more secure than other locked down browsers run as a less privileged user is that since you can't remove IE you've up the system's complexity by adding the second browser. Giving the entire system less assurance, in pracitcal terms it means that many expolits will be able to target the application they wish and this means that your new browser and IE are valid targets. (This however does not include browsing exlpoits, but since comparing those merely comes down to a conversation about bug counts as most browsers offer the same types of security mechanism there really is no point.)
And now you are telling me that is not true. Can I yust get facts here.Quote:
3. If IE is not running (and preloaded DLL's do not count) then IE will not be exploited. If a second browser is installed then the second browser alone is prone to exploits, and not to an exe that is not running. Memory footprint of the dll's loaded for IE are not just IE only DLL's and are thus system wide DLL's. Thus it is not the browser but the DLL's the system uses to tie multiple applications into. Whether you use one browser or two, the risk is not elevated.
I preffer opensource myself it verywell may be inferior but the idea behind is suits me better. And if both could be turned into one then we would have the best method ever :DQuote:
Ah the open source argument... did you know that the average lifespan of a Linux source level bug is nearly 2 years. Woo "incredibly fast"... no doubt. (I'll send you my documentation from the Stanford CSL if you doubt this fact) Open source is an inferior development model, (stage 1 on http://www.sei.cmu.edu/cmm/cmm.html )
This is some nice info here and it looks like there are two camps. Is there anyone else with a different opinion around here?
Uhmm Led me add and Correct a few Things
FireFox:
- Opensource
- ActiveX Disabled (No directX disbled)
- Less targeted
- PopupBlock
- More secure codebase
- Both can do that (you can also disable javascipt and java)
- Slower loading Yes one time Starting that is , After that it Considrably Faster then IE
IE:
- Closedsource
- Activa X Enabled Can be disabled by the setting though(DirectX enabled)
- Less secure codebase
- Targeted more
- Strict in formating HTML
- Faster loading/ You can say that when all the shared libraries are already loded in the memory, By is considrably slower in Surfing than FireFox
Being Open Source it has the Ability to Gain from the Experiences of a vast amout people.Quote:
If that is true won't firefox get less secure when it gets more popular ?
The actual underlying Code(Base/Plateform on which all versons are designed) of Motzilla is nore Stronger than IE. Which has to frequently relese Patches to patch up Vanurelibilites.Quote:
eeuh.......... I don't really get the part of the codebase.
HTMLQuote:
I like that to programming wether it is C++ or HTML or JAVA should be done proper.
Definately is , On the other Hand IE such integrated into the system that Windows cannot live without it, It's always loded in the memry. Only thing is That when oyu start Firefox it has to first load all its libraries into the memory that takes considrable amount time.Quote:
That's a good thing right. If all of FireFox's libraries and stuff still have to ge loaded it means that it doesn't use stuff that is intgrated into windows. That makes it more secure.
Windows IE inseprable no sir you cann't Take them apart, So now we cannot get rid of it and it has it's share of Vanurablities, Adding another will definately Bring His Share of Vanurablities, theurycally i would say a fair comment Sue microsoft for that to make it uninstallable :mad: . But the Second Browser is Secure enought then i will take the risk.Quote:
Does having a second browser installed make my system less secure. Or am i yust reading this wrong. Also when running as a normal user I get the same problems as while running as admin in IE. Or do you wan't me to use the guest account for real because I kind of disabled that.
Try to use Guest Account as much possible it will reduces the threat level . Consider a Cracker getting a Guest access and him/her getting a Admin Access.
inferior :mad: , you are saying Linux inferior, FireFox Inferior Grrrrrrrr. Open Source is not Inferior Mr. Open Source has the Ability to learn, Gatheg Knowledge from Vast number of People.Quote:
I preffer opensource myself it verywell may be inferior but the idea behind is suits me
I think i get it for the most part. And i'm yust going to continue using FireFox.
Thanks a lot.
*activates lurker mode*
Why not using Opera browser, it contain a lots of features. But as nihil said, nothing is "secure". The others is depend on how you setting them. FireFox also is a good browser, I have tried it once, but I changed to Opera, because I was attracted by Opera's Interface, I'm not sure about the security in FireFox and Opera, what I know is Opera was the best browser I ever use.
Actually, to tell you the truth, i have tried several different browsers and browser addons. Opera, used to be my choice, then i tried firefox (which i like) and then i tried MyIE2. My favorite by far is MyIE2. It blocks popups, and supports tabbed browsing and has a much simpler interface than Opera. I have tried the latest version of opera and did not like it at all. I felt the controls were too clunky. I would have to recommend MyIE2 as the browser of choice as i have had NO problems whatsoever with it (other than the actual loading of pages can be a little slow at times)
MOZILLA WOOOOOOOO. Yeah. Just one thing to point out, if you want to put restrictions on your browser like you say catch, that is fine and dandy if you are running a big lab or an office. But for a personal pc, well correct me if I am wrong, but that is stupid as I'll get out.
I trust that you feel the same way, as it would piss you off if you had to change users every time you wanted to use your browser out of guest mode. Like a really long su.
So for a large network with many nodes, I don't blame you and I more than likey would go with your route catch. But for a single user, bah, I'll just use my mozilla and be happy.
edit:
MOZILLA WOOOOOOOO
Relying on applications to be responsible for their own security is just plain bad policy. Be the application a web browser, email client, web server, name server, whatever...
Think about it, if you utilize concepts of least privilege (even without other security mechanisms) it doesn't matter if your applications are secure. If your browser is logged in as a user with only enough privileges to web browse, then it doesn't matter if it gets exploited because the exploit will also run with only enough privileges to web browse... not enough to actually harm the system. Every single high security system utilizes this concept to a high degree. Lower security systems (NT, UN*X, Linux) also have the ability to use least privilege although (particularly in the case of Linux and UN*X) to a lesser degree of granularity.
As for the burden it places on the user, simply creat a short cut for your application, set it to run as a different user and then to run as that user everytime (little checkbox) and use a guest type user with no password. Ensure this user can only log in locally. After the initial setup, running the application is seamless.
catch
You people do this for a living, and none of you could type "Links" as the most secure browser??
Of course this post is nothing more than me trying to start a discussion on browser security including more than the 3 or so mentioned =D
Is this the browser you were talking about ?
http://artax.karlin.mff.cuni.cz/~mik...shots/jpg.html
Could you tell me why you like this. Because unless your working on a
linux/unix box without X it seams a bit useless. But you got my attention.
Why do you like it. And to continue are there any other browsers out
there worth to take a look at besides:
IE
FireFox/FireBird
Opera
Links
MY IE 2
And who here uses MyIE2 ? Because I never heard of it before?
Is this possible in XP pro ?Quote:
As for the burden it places on the user, simply creat a short cut for your application, set it to run as a different user and then to run as that user everytime (little checkbox) and use a guest type user with no password. Ensure this user can only log in locally. After the initial setup, running the application is seamless.
Links is the ****! I run a few UNIX/Linux/BSD boxes and sometimes I close X down completly...actually I do that a lot.. Anyway, Links allows you to use a lot of features that usually you'd need to load X for.. I just woke up and I'm going to work soon so forgive any spelling errors, and maybe I'll add more to this in a while...Like in a few hours heh. Links is awesome though. Text based browser which is GREAT for testing new web site creation ideas, and you can have frames!
If you build a website, look at it in links. If you can links it, **** it. =D
Mostly Opinion, but it is a good text based browser. Which is why on MY REAL web page, you can actually view that in links, as the only picture on the whole damned page is one saying "Microsoft free" and that is what the server came with, I just left it on.
I prefer FireFox as well, but rig IE up with FreeSurfer pop-up blocking and Analog X's Cookie Wall, and it suddenly becomes a formidable contender.
With all due respect, I must say said quote is very naive. You can never afford to be that confident in an application. No matter how awesome your settings are, believe you me there's a user out there who can screw it up so that your security goes down the drain. An application, regardless of its settings, is only as good as the human behind it.Quote:
Think about it, if you utilize concepts of least privilege (even without other security mechanisms) it doesn't matter if your applications are secure.