Firefox more secure than IE?
Discussion
I currently use Firefox (I simply find it to be a better product than IE) but a lot has been made of it being more secure than IE.
Is the program inherently more secure or is it simply a result of more users on IE and so spyware writers and scammers exploit flaws in the program because there are far more users they could catch out?
Is the program inherently more secure or is it simply a result of more users on IE and so spyware writers and scammers exploit flaws in the program because there are far more users they could catch out?
A lot of the spyware is targetted at the biggest users - hence IE, some of the trojans against the biggest users, again IE but also because the virus/trojan writers have a problem with Microsoft taking over the PC world.
Firefox may not be as secure as IE now as all these attacks on IE show up problems which are fixed, since there haven't been the same attacks on Firefox the weaknesses haven't been highlighted, yet
Firefox may not be as secure as IE now as all these attacks on IE show up problems which are fixed, since there haven't been the same attacks on Firefox the weaknesses haven't been highlighted, yet
FourWheelDrift said:
A lot of the spyware is targetted at the biggest users - hence IE, some of the trojans against the biggest users, again IE but also because the virus/trojan writers have a problem with Microsoft taking over the PC world.
Firefox may not be as secure as IE now as all these attacks on IE show up problems which are fixed, since there haven't been the same attacks on Firefox the weaknesses haven't been highlighted, yet
Thats what I figured, hence why Unix and Apple machines are considered more secure - because people aren't trying to attack them!
It'll be interesting to see if the rise of Firefox creates a new breed of spyware and trojans specifically targeted at that browser.
egomeister said:
I currently use Firefox (I simply find it to be a better product than IE) but a lot has been made of it being more secure than IE.
Is the program inherently more secure or is it simply a result of more users on IE and so spyware writers and scammers exploit flaws in the program because there are far more users they could catch out?
[canofworms mode=open]
The biggest problem with IE is that it is "built in" to Windows, so any program that needs to render a web page will call the IE rendering engine to do it. That means that any exploit in IE affects *all* of Windows. Add on to that the way that a lot of Windows programs run at enhanced levels of privilege, then an IE exploit is potentially more serious than a Ff one.
It is also my opinion that the standard of programming, especially in relation to secure programming methodology, at MS is not up to industry standards. Also, IE is not subject to the "million pairs of eyes" review that Ff is.
The "more users" argument is a red herring. It makes an exploit more serious and widespread, which is attractive to the script kiddies, but the people who actually develop exploits don't care.
[/canofworms]
egomeister said:
Thats what I figured, hence why Unix and Apple machines are considered more secure - because people aren't trying to attack them!
Simply untrue, I'm afraid. Unix properly implements seperation of privilege, unlike Windows.
In some ways, you'd think crackers would concentrate on Unix, since all corporate firewalls run on Unix O/Ss, and the ability to crack them would be priceless.
zumbruk is right. The way Windows is designed, with Outlook, IE, Messenger etc all built in to the OS makes it inherently less secure than something like Unix or indeed even using a Firefox browser within Windows.
The other reason Windows is less secure is users. Many Windows users run their day-to-day activities (email, Web surfing etc) using an account with administrator privileges. This is much less likely under Unix/Linux as the users are simply more intelligent.
The other reason Windows is less secure is users. Many Windows users run their day-to-day activities (email, Web surfing etc) using an account with administrator privileges. This is much less likely under Unix/Linux as the users are simply more intelligent.
zumbruk said:
Thats what I figured, hence why Unix and Apple machines are considered more secure - because people aren't trying to attack them!
Simply untrue, I'm afraid. Unix properly implements seperation of privilege, unlike Windows.
In some ways, you'd think crackers would concentrate on Unix, since all corporate firewalls run on Unix O/Ss, and the ability to crack them would be priceless.
And when it was popular. They did. And they got in. The first worms were UNIX ones.
Don't get me wrong: Unix is pure, Unix is beautiful, and yes Unix tends to be more secure. Its been around a long time and many, many security holes have been found and plugged. But one should not interpret this as being fully, completely secure.
As to Windows: Given it is, without doubt, one of the greatest efforts in the history of mankind it is unsurprising it recieves the harshest scrutiny in terms of its security that any piece of software that has ever been written.
Frankly I find it astonishing that so little goes wrong!
Is Firefox really more "secure". Maybe, quite possibly yes. Is IE quite secure enough? Largely - I've never in eight years of using it had an exploit hit my machine. I have, occasionally, had my anti-virus step in to do things - but this has happened two or three times in those eight years.
Even so I take the security of my computers very seriously. But given that - I've *never* had a problem.
1) Maintain a proper hardware firewall
2) Use NAT
3) Run proper anti-virus with malicious script blocking and spam filtering
4) Run an "on-PC" software firewall
All these should be done regardless of what browser you are using.
Security is an industry wide problem and is no longer IE specific.
Last year Symantec attacked the perceived security advantages of Firefox and claimed people were living in a "false paradise".
The Register ran the full article - www.theregister.co.uk/2005/09/19/symantec_threat_report/
Last year Symantec attacked the perceived security advantages of Firefox and claimed people were living in a "false paradise".
Graham Pinkney said:
(head of threat intelligence EMEA at Symantec)
...switching from IE to Firefox as a way of minimising security risks was no longer valid advice. "Cross-site scripting attacks have been used to attack more vulnerabilities in Mozilla browsers over the last six months than IE,"
The Register ran the full article - www.theregister.co.uk/2005/09/19/symantec_threat_report/
egomeister said:
Thats what I figured, hence why Unix and Apple machines are considered more secure - because people aren't trying to attack them!
Apple maybe, but IIRC more than 50% of web sites run on Unix/Linux, so you bet you arse it's getting attacked! Windows servers running websites has only really taken off in the last 6 years or so I think (prepared to be shot down here but I'm pretty sure)
zumbruk said:
Security is an industry wide problem and is no longer IE specific.
Last year Symantec attacked ...
Never *ever* believe a security vendor. They sell their products on the back of fear.
I work in conjunction with a number of security vendors, and we examine our own attacks. Although to an extent I would agree with you, the fact remains that security is an issue, and an increasingly improtant one given the way that people and company's alike deal with data.
If you truely believe that another browser is more secure, then fine use it, although personally I don't believe that to be the case... check out Firefox's own list - the patches and vulnerabilities are only increasing with time.
The largest source of problems do still appear to be user understanding / education related. How many "warning" e-mails do you still see about hoax virii..? Not to mention the shere volume of phising e-mails that people follow, despite the warnings in the press..?
aldi said:
Thats what I figured, hence why Unix and Apple machines are considered more secure - because people aren't trying to attack them!
Apple maybe, but IIRC more than 50% of web sites run on Unix/Linux, so you bet you arse it's getting attacked! Windows servers running websites has only really taken off in the last 6 years or so I think (prepared to be shot down here but I'm pretty sure)
Ah, didn't really consider it from a webserver point of view - I can see why effort would be made to exploit weaknesses in a webserver situation. I have more experience with Unix based machines being used to run engineering software in a end-user type situation.
Don said:
Thats what I figured, hence why Unix and Apple machines are considered more secure - because people aren't trying to attack them!
Simply untrue, I'm afraid. Unix properly implements seperation of privilege, unlike Windows.
In some ways, you'd think crackers would concentrate on Unix, since all corporate firewalls run on Unix O/Ss, and the ability to crack them would be priceless.
And when it was popular. They did. And they got in.
"When it was popular"? When did it stop?
Don said:
The first worms were UNIX ones.
Yeah, I know. I've been doing this s**t for a living for a *long* time. (Since 1977, in fact.)
Don said:
Don't get me wrong: Unix is pure, Unix is beautiful,
It's not *that* good. The file permissioning model is way past its sell-by, the lack of ability to assign elevated permissions to users without giving away everything (as root), NIS and NISplus suck copiously and it seems likely that SMB/CIFS is more secure than NFS.
It's still better than Windows, though. It properly supports seperation of privilege, large parts can be removed if enhanced security is required (try running Windows without the portmapper) and the tradition of not running stuff with enhanced privilege is well established. Running a PC without constantly having to use Administrator privilege is a PITA.
Don said:
As to Windows: Given it is, without doubt, one of the greatest efforts in the history of mankind it is unsurprising it recieves the harshest scrutiny in terms of its security that any piece of software that has ever been written.
Frankly I find it astonishing that so little goes wrong!
And I find it astonishing how crap it is.
This very week, I want to print 20-odd Word documents. I select them all and drag and drop them to the printer. After I've closed about 50 popups about other popups being open I have to reboot to get control back and print them one at a time. Pathetic.
Don said:
All these should be done regardless of what browser you are using.
Hear, hear.
Ooh I've been dying to use this link all week:
http://chuvakin.blogspot.com/2006/03/
>> Edited by neil_cardiff on Friday 10th March 11:17
http://chuvakin.blogspot.com/2006/03/
>> Edited by neil_cardiff on Friday 10th March 11:17
zumbruk said:
"When it was popular"? When did it stop?
Come come. Yes it is certainly still in mainstream use. But surely you recognise that many, many more business-server-apps are now hosted on Windows Server operating systems...as to which is dominant - couldn't tell you - I suspect Windows...
zumbruk said:
The first worms were UNIX ones.
Yeah, I know. I've been doing this s**t for a living for a *long* time. (Since 1977, in fact.)
Me too. First job in computing was at the Progamming Research Group at Oxford University. Nothing grand (glorified tea-boy) but I learned to code. Early eighties. Cut my teeth writing middleware and bespoke networking for PDP11s. Wrote my first UNIX code around then...all long before Windows.
zumbruk said:
This very week, I want to print 20-odd Word documents. I select them all and drag and drop them to the printer. After I've closed about 50 popups about other popups being open I have to reboot to get control back and print them one at a time. Pathetic.
That "print service" feature is utter rubbish. Mind you - printing always has been. Why on earth the Office guys haven't coded document printing into Windows Services I'll never understand. But there you go. I don't rate that as the o/s fault...although it *should* be able to successfully interrupt ANYTHING - and sometimes it can't, its true.
zumbruk said:
All these should be done regardless of what browser you are using.
Hear, hear.
Plain good sense. But persuading home users on a tight budget and with little expertise to secure their systems is not easy - I know - I end up "supporting" the family (as you probably do). Total PITA.
Podie said:
I'm not sure the industry and the people who work within it are the most helpful at resolving these issues either...
Its one of the things that Apple worked out. If something is too complicated for a non-computer-literate user to remember how to do easily - then don't let them do it! Find some way for the o/s to do it *for them*.
Its easy to forget after a lifetime in the business that some people literally have no idea how these things work - and still want to be able to use them!
The motor industry have done a great job. You really, really, need to know virtually nothing about how a car and its systems work to drive it. We can learn from them. (Cue classic quotes...)
Don said:
I'm not sure the industry and the people who work within it are the most helpful at resolving these issues either...
Its one of the things that Apple worked out. If something is too complicated for a non-computer-literate user to remember how to do easily - then don't let them do it! Find some way for the o/s to do it *for them*.
Don said:
The motor industry have done a great job. You really, really, need to know virtually nothing about how a car and its systems work to drive it.
Oh, I dunno. Ever tried to use iDrive?
zumbruk said:
I'm not sure the industry and the people who work within it are the most helpful at resolving these issues either...
Its one of the things that Apple worked out. If something is too complicated for a non-computer-literate user to remember how to do easily - then don't let them do it! Find some way for the o/s to do it *for them*.
Good point.
zumbruk said:
The motor industry have done a great job. You really, really, need to know virtually nothing about how a car and its systems work to drive it.
Oh, I dunno. Ever tried to use iDrive?
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff