Browser Security Review

OK all you browser fanbois get your teeth stuck into this:

It is a test of certain aspects of browser security :p

Quote:

---

CARLSBAD, CA, Aug 13, 2009 (MARKETWIRE via COMTEX) -- NSS Labs, a world leader in independent product analysis and certification, today published its second round of live browser security tests. Two separate tests measured protection against phishing and socially engineered malware across 5 browsers: Apple Safari 4, Google Chrome 2, Mozilla Firefox 3, Opera 10 Beta and Windows Internet Explorer 8.

Socially engineered malware is the most common and impactful threat on the Internet today, with browser protection averaging between 1% and 81%. Internet Explorer 8 caught 81% of the socially engineered malware sites over time, leading other browsers by a 54% margin.

Safari 4 and Firefox 3 caught 21% and 27% respectively, while Chrome 2 blocked 7% and Opera 10 Beta blocked 1%.

Phishing protection over time varied greatly between 2% and 83% among the browsers. Statistically, Internet Explorer 8 at 83% and Firefox 3 at 80% had a two-way tie for first, given the margin of error of 3.6%. Opera 10 Beta, exhibited more extreme variances during testing and averaged 54% protection. Chrome 2 consistently blocked 26% of phishing sites, and Safari 4 offered just 2% overall protection.

Firefox 3.5 crashing issues prevented it from being tested reliably. :D

The URLs sample set used in the test was representative of the phishing and socially engineered malware threats Internet users face every day. "In addition of comparing browsers among themselves, the test also benchmarked the browsers against cybercriminals," said Rick Moy, President, NSS Labs. "While the other browsers maintained or decreased protection between the two tests, Internet Explorer continued to improve its protection against cybercriminals." The full text and analysis of these and other reports on browser security can be found at http://nsslabs.com/browser-security.

---

Enjoy! :)

while I do admit surprise at the results, I have to point out that even 81% is not all that stellar. Still leaves plenty of room for infection.

I guess FF will need to change the whole

Quote:

---

The Firefox Web Browser is the faster, more secure, and fully customizable way to surf the web.

---

statement then?


Quick here come the FanBoy's... :D

I wonder if that's Firefox with any add-ons installed or just a vanilla installation. Out of the box, IE8 is more secure than all of them (and I'll admit that without a review), but with the addons installed (Ad-block, No-Script, etc), I think Firefox will give IE a run for it's money.

And that's one thing which gives firefox a heads-up over IE8. The ease in creating, customizing, and installing addons for the browser. IMHO.

Have a great day:)
Patrick.

This is typed in Firefox only because that's what opened the first time I checked the forums. Typically, I surf in IE8.

Also, here's Ars Technica's take on the report
http://arstechnica.com/microsoft/new...ost-secure.ars

It does skew the facts a little, that Microsoft sponsored the tests--although according to NSS Labs, it was Microsoft's Security Engineering Team that sponsored the tests as a way to foster improvement in IE8.

My personal take is that IE8 is good, although on one of my systems I have nothing but problems with it (both on Vista and Windows 7 RC). On my other system it's doing a fairly good job -- although I haven't installed anything else to compare it with. And I don't use the third system enough to actually give an opinion about it. But, all three of my systems are running IE8 either upgraded or because they run Windows 7.

Have a great day:)
Patrick.

Quote:

---

The ease in creating, customizing, and installing addons for the browser. IMHO.

---

Except that all browsers have that. What Firefox doesn't have is process merging and crash recovery.

Why would they test opera 10 (which is in beta 3 now).. why couldn't they test the current stable version ?

Quote:

---

Originally Posted by PatrickDickey

but with the addons installed (Ad-block, No-Script, etc), I think Firefox will give IE a run for it's money.

And that's one thing which gives firefox a heads-up over IE8. The ease in creating, customizing, and installing addons for the browser. IMHO.

Have a great day:)
Patrick.

---

Ie has similar offerings. Check out IE7Pro

Quote:

---

IE7Pro is a must have add-on for Internet Explorer, which includes a lot of features and tweaks to make your IE friendlier, more useful, secure and customizable. IE7Pro includes Tabbed Browsing Management, Spell Check, Inline Search, Super Drag Drop, Crash Recovery, Proxy Switcher, Mouse Gesture, Tab History Browser, Web Accelerator, User Agent Switcher, Webpage Capturer, AD Blocker, Flash Block, Greasemonkey like User Scripts platform, User Plug-ins, MiniDM, Google sponsored search,IE Faster and many more power packed features. You can customize not just Internet Explorer, but even your favorite website according to your need and taste using IE7Pro.

---

And there is also an active userscript's also.


There is a version coming out that will be more compatible with ie8, but this current version works fine under ie8, just need to have compatibilty mode turned on. :)

You can get the test results straight from NSS Labs at http://nsslabs.com/browser-security

Also, the IE Blog had a post regarding thier malware protection last week - http://blogs.msdn.com/ie/archive/200...en-filter.aspx

- Jake

MSFT Internet Explorer Outreach Team

Quote:

---

You can get the test results straight from NSS Labs at http://nsslabs.com/browser-security

---

... as Nihil pointed out in his original post...

I personally use Chrome for fast browsing and Firefox for anything involving logging into stuff, like email, banking, etc. (Keep in mind I have nothing against IE, but getting it to work on Ubuntu is tricky). I agree that a stock install of FF is less secure than IE8, but I would be interested to learn how many people install FF plugins to increase security.

thanks for the urls jake_ie8team. I honestly didn't even spot them in Nihil's post.

I guess somepeople are a little Grumpy today huh? ;)

Quote:

---

Originally Posted by keezel

I personally use Chrome for fast browsing and Firefox for anything involving logging into stuff, like email, banking, etc. (Keep in mind I have nothing against IE, but getting it to work on Ubuntu is tricky). I agree that a stock install of FF is less secure than IE8, but I would be interested to learn how many people install FF plugins to increase security.

---

it's the only thing that keeps me from switching to Linux, the programs that will and will not run on it.

Quote:

---

Originally Posted by JPnyc

it's the only thing that keeps me from switching to Linux, the programs that will and will not run on it.

---

What keeps me away from linux is the community behind it and I'll say the same for firefox.

Linux attracts these stereotypical overweight losers who only use the OS because they can't go online for more than five seconds without being infected with malware. And people seem to use Firefox because their brainwashed into thinking it'll be the end-all to any problems or misunderstandings they have with computers.

I mean, come on... admit the fact that windows is targeted at grannys and toddlers. And if you still can't seem to grasp the software then you shouldn't even own a computer.

That's not the reason I'm looking to say goodbye to Windows. There hasn't been so much as a tracking cookie on my machine for ages. It's the ever increasing bloat of Windows OS. Of course I haven't tried Windows 7 yet, but I know that using vista on someone else's machine makes me suicidal within five minutes. However it's a moot point because there's software I absolutely have to use and it won't run on anything but Windows.

My install is around 370 megabytes while the modern video game installs are around two or three gigabytes. Plus a hell of alot more if you're running it off an ISO.

Quote:

---

Originally Posted by JPnyc

However it's a moot point because there's software I absolutely have to use and it won't run on anything but Windows.

---

Joe what Software?

why not just do a dual boot and keep the windows partition for the software.?

Quote:

---

Originally Posted by t34b4g5

Joe what Software?

why not just do a dual boot and keep the windows partition for the software.?

---

Or VirtualBox.

I have machines running Windows, Linux, and Mac OS. Each seem to have their strengths and weaknesses. Same goes for browsers. I used to get into the OS/Browser wars, but now I just say 'to each their own'.

I typically use Linux for everyday tasks, but I wouldn't fault someone for using a different OS.

Just my $0.02.

There'd be no point to it. I would be constantly using only the Windows side.

Quote:

---

Originally Posted by JPnyc

There'd be no point to it. I would be constantly using only the Windows side.

---

Have your tried to see if you can get the apps to work under wineHQ?

still curious to know what software?

well pretty much everything I use is Windows-centric, but specifically Dragon NaturallySpeaking.

Quote:

---

Originally Posted by t34b4g5

Have your tried to see if you can get the apps to work under wineHQ?

still curious to know what software?

---

See, that is the thing... Wine is alright, but there are several programs that are pretty flaky when used with it. Why go to all the trouble, just to use Linux, when Windows will work just fine for you?

As I said, I use Linux for most things, but I don't use much software that will only work in Windows.

Though when I am making changes to group policy, or AD at work, I don't try to run the admin tools through Wine, just so I can stick with my prefered OS... I use Windows.

exactly, and even on Windows Dragon NaturallySpeaking is an awful, buggy, and unbelievably frustrating piece of garbage software that I am convinced was developed by Satan, himself. I can't imagine how much worse it would be trying to run it through wine on Linux.

This must be one of those things where I lucked out huh? The only software I used on Windows was IE and Pinball. Most of the stuff I use CAN work on Windows, sort of, but like, one of the main apps, LMMS, until recently, it was the opposite of what everyone else is saying; It worked on Linux the best, and ran on BSD good, but on Windows a lot of stuff was broken to the point you didn't use it.

Now they HAVE fixed it I will say, because I grabbed the Windows copy for my Laptop to try out, and it not only runs fine, it actually works.

The only real issue is if you upload to myspace.com like I do, you need to go find lame or something else to make MP3s because it can only export as either WAV or OGG. Not that it's a big deal, I mean seriously, OGG is just as good as an MP3 from what I've read, but Myspace and other things expect an actual MP3 to use so you generally export your music project file as WAV, and you can do it at up to 320 KBps and do VBR if you like, but I'm not really sure how well MP3 tools work on Windows because I haen't ever used them. I have my FTP server set up and whenever I make a new song, I just back up the whole projects directory to my server, grab it on one of my boxes, and use lame to encode it.

All the other stuff I use, is mainly Linux or BSD made sofware. I use Word sometimes, and parts from Office, but other than Word, everything else has something for Linux. (I don't care about or for Open Office all that much other than I understand how much time was put into it, and it DOES run, but I actually prefer Word over "Writer" or whatever they call it) Email apps I can't stand Windows most of the time other than Outlook and the new Windows Live Mail which is probably better than most of what Windows has had before. As for browsers, I use Opera a lot. I do use versions of Firefox sometimes, but not in any joy or anything, it's terrible.

I've used "Links" a few times just to not have to load Firefox when I had to check something out.

Quote:

---

Originally Posted by JPnyc

exactly, and even on Windows Dragon NaturallySpeaking is an awful, buggy, and unbelievably frustrating piece of garbage software that I am convinced was developed by Satan, himself. I can't imagine how much worse it would be trying to run it through wine on Linux.

---

I am still giggling at the satan part. :p

anyhow i'm sure there would be a naturallyspeaking equivilant both for win & *nix.

not sure though as i've never felt the need to setup my boxes for voice recognition stuff.

you'd think so wouldn't you. You'd be mistaken however.

I tried to get Moodle (http://moodle.org/) to run on one of our Windows servers, but getting to run Apache/PHP/MySQL on Windows Server was more headache than I care for... So I have taken the unprecedented step of running some of our production stuff on a Linux server, and I have still not gotten over it.

How about running .Net on Linux? Visual Studio? SQL Server? I'm sure it can be done, but it sounds like a big cluster of you-know-what...

I've never had problems. But then I've always used packages like xampp instead of downloading and configuring it all seperately like some sort of retard.

Novell used to have an SQL thing on one of their product pages but I don't know if it's still there or not. It basically let you do that stuff without the bottle of head ache pills usually required. I have it on DVD here somewhere after getting one of their guys to send it to me so I could use it with one of the classes I took to get a better grasp. It's a little dated the copy I have but I got it free so I can't complain much. They sent that AND the server versions of their stuff to run it all on. (SUSE Server, Novell OpenServer, Nterprise, Groupwise, ConsoleOne, and about 4 other things. Some of them were on the LTRK they were sending out and some weren't.

They also had another tool I've got here somewhere I also got for free from Novell that was for Database servers so you could do other stuff without head aches.

If you have to use Linux and Windows together on servers, or in a cluster of mixed stuff like Windows and Linux, just get Novell. Microsoft gave them a stamp of approval years ago. (Microsoft also sells SUSE / Novell to customers who Windows doesn't work for, like sites who have been using Unix or Novell for 20 years and don't want to switch) so Microsoft started selling too.

Quote:

---

Originally Posted by The-Spec

I've never had problems. But then I've always used packages like xampp instead of downloading and configuring it all seperately like some sort of retard.

---

I downloaded it earlier and have been fiddling with it on a spare machine. So far it's been interesting.:)

Quote:

---

Originally Posted by jake_ie8team

MSFT Internet Explorer Outreach Team

---

IE Outreach Team?