Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google-Funded Study Knocks Firefox Security

Posted by Soulskill on from the time-to-argue-again dept.

Sparrowvsrevolution writes "Researchers at the security firm Accuvant released a study Friday that gauges the security features of the top three web browsers. Accuvant admits the study was funded by Google, and naturally, Chrome came out on top. More surprising is that Internet Explorer was rated nearly as secure as Chrome, while Firefox is described as lacking many modern security safeguards. Though the study seems to have been performed objectively, it won't help Google's fraying partnership with Mozilla." The full research document is available here (PDF), and it goes into much greater detail than the Forbes article. Accuvant also published the tools and data they used in the study, which should help to evaluate their objectivity.

5 of 225 comments (clear)

  1. Opera by jaak · · Score: 5, Interesting

    The researchers dd not evaluate Opera in their study. I wonder how that would have compared...

    1. Re:Opera by kangsterizer · · Score: 5, Interesting

      They don't care about opera. It's not a technical study. It's a marketing study.
      Opera has no market share. Chrome's easiest target is Firefox.
      IE's easiest target is Firefox too, and they made a similar advertising study, where IE is on top of security, way ahead of Chrome - but not too much.
      Both put Firefox down.

      All of them fail to mention other security features of Firefox. All of them fail to mention noscript and the like.
      (and before you ask a list, take a look at Firefox's separated memory management per tab, or frame poisoning protection, etc.)
      Also, no mention of CVE count of course, aka the actual discovered vulnerabilities.

      That's just making a checklist where you put names of technologies that the opponent doesn't have, but don't put names of the ones you do not have.
      Then put a mark in front of them to make you appear better.

      In the past they've been (as in all corporations) doing that for ages, Microsoft certainly did a lot of it. The difference here is that they now buy out companies to do it for them.

  2. Re:Chrome and IE are the most secure browsers by InsightIn140Bytes · · Score: 5, Interesting

    You would only gain additional security if the exploits actually targeted the browsers. They don't - most of them target plug-ins and work in every browser. Now, both Chrome and IE sandbox them and have extra security layers for plug-ins just so that even if plug-in is vulnerable, you can't actually gain access to system. Since Firefox doesn't offer any of these options, you gain access directly after compromising the plug-in.

  3. Re:Chrome and IE are the most secure browsers by InsightIn140Bytes · · Score: 5, Informative

    If you browse the same site for Chrome, you'd notice that the list is about same length for the latest version. And the total vulnerability count is huge for Firefox compared to Chrome and IE.

  4. Firefox still a single-process browser by Animats · · Score: 5, Informative

    Many of the security issues mentioned in the paper for Firefox come from the fact that Firefox is, for historical reasons, a single-process browser. It's the last of the single -process browsers.

    This is both a performance problem and a security problem. Even add-ons aren't yet running in separate processes. The Mozilla project to make Firefox multiprocess is behind schedule and in trouble.

    "Fennec", the Mozilla browser for mobile devices, is already multiprocess. But getting that machinery into the main line of Firefox has run into problems, and, after two years of effort, multiprocess Firefox is now on hold. "Converting an established product, like Firefox, from a single- to multi-process architecture requires the involvement and coordination of many teams. ... Electrolysis requires a large investment of resources and time and has a long timeline for completion. How long? At this point we do not have a definitive answer...."