Microsoft lauds IE as 'the most secure browser'

[MrLinus]

Uh huh. Right. Sure. You know, with this kind of logic, you gotta wonder sometimes. Last time I checked, IE could still be used for a variety of malicious attacks.

Source: ZDNet UK

Internet Explorer is now just about the most secure browser available, says Microsoft - because so many security holes have been filled

Last week's Internet Explorer patch has made the browser at least as secure, if not more secure, than any other browser, according to Microsoft UK's chief security officer.

Microsoft released a security patch for Internet Explorer last Monday that fixed three critical vulnerabilities; unfortunately the patch altered the way in which the browser handles certain URLs and forced many companies to reprogram their systems in order to accommodate the change. However, Microsoft has said the update means that Internet Explorer is now safer than any of the other browsers on the market, which users may find ironic due to the sheer number of vulnerabilities discovered in the browser over the past year.

Stuart Okin, chief security officer at Microsoft UK, told ZDNet UK that he knew "a proportion" of customers would have problems after the change, but because of the high risks involved, the company decided not to wait any longer and released the patch: "We don't actually know how many users or systems or Web administrators have been affected by this, but we knew there was going to be some with only a week's notice," he said.

Okin said that the longer the vulnerability was around, the more chance it would be exploited, which may have caused even more damage, so a week's notice was a compromise: "There are always going to be people that are caught out and surprised because they haven't been working with us or didn't know there was a problem. If we had given people more notice, then the risk would have been higher that someone would have used that exploit. If we had given them no notice, then they would have had more of a problem trying to fix their systems," he said.

Now the vulnerability has been fixed, Okin said Internet Explorer is at least as secure as other browsers such as Opera and Mozilla, but in some ways it is more secure: "I don't think we have got any less security than any of the other browsers and we have added a layer of protection that could make it a little bit more obvious to users if a phishing attack is occurring. If you look at today's technology, absolutely the (IE) browser is as secure as the others," he said.

But Okin warned that the fight against attackers and virus writers is far from over: "Don't get me wrong, vulnerabilities will come out and we will patch them; vulnerabilities will come out for our competitors and they will patch them as well. That is not going to change. I keep telling people that phishing attacks will continue in the future and they will catch people out," he said.

Two years after launching its Trustworthy Computing Initiative, in which Microsoft made security its first priority, the company still has a lot of work to do; not just for Internet Explorer, but for most of its software portfolio, Okin said. "We feel we need to do a lot more in terms of the browser, Windows and basically the entire technology base. It requires us to move onto the next level of security as an industry," he said.

[moxnix]

Well I am a little bit of a doubter in M$N security. I do believe that I will continue using Mozilla Firebird.

[lumpyporridge]

seems to be quite a list still even with three gone http://www.safecenter.net/UMBRELLAWE...hed/index.html

[MrLinus]

lumpyporridge, that's a bit dated in that it doesn't include recent fixes (the list date is January 27, 2004). That aside..

[cwk9]

Think I'll stick with firebird until microsoft decides to stop sitting on security flaws for six months.

http://slashdot.org/articles/04/02/1...id=190&tid=201

[Lansing_Banda]

I think it is funny that Microsoft released a patch to fix a previous patch. As for secure, ha it doen't even block popups.

[Alphaflux]

yea i think im with Cwk on this one, microsoft waits horrendously long to even think about putting out patches for good sized security holes in its software, the amount of money people pay for mircosoft OS's, holes should be patched within days of them being found :/

[nihil]

I guess the argument is similar to operating systems?.......Internet Explorer is the most common, so the most likely to be exploited?

I would not say it was the "most secure" because it has the most patches, although I can see the theoretical logic behind the argument. I would say it is the most insecure because it is the most obvious target?

What I am saying is that other browsers "seem" more secure, but that is only because they are not in the firing line.

Cheers

[SirDice]

This whole article is based on 1 (one) "feature" they switched off. Namely the http://usernameassword@some.site.com issue alot of those spammers use (or should I say abuse?).

There's still alot of debate about whether or not this "feature" should have been build into the browser in the first place (MS started to use it and other browser manufactures quickly followed).

Edit: The URL gets screwed up with smileys