CFA/Security-Research
From MozillaWiki
< CFA
« Comparative Feature Analyses
« Security Notes
Contents
General Browser Capabilities
- Anti-Phishing
- Malware Detection
- Passwords
- Content Enabling
- Cookies
- Warning Messages
- Encryption (Protocols and Certificates)
- Other
Purpose
Examine a bunch of browsers, existing Firefox Add-ons, and web services to generate a report that describes:
- Which capabilities each has
- A summary of where each is different/unique
- Some conclusions about which aspects seem most innovative and interesting that we might want to consider for Firefox
Browsers to investigate
- Firefox 2
- Camino
- Flock
- iCab
- IE 7
- Maxthon
- Netscape
- OmniWeb
- Opera
- Safari
- SeaMonkey
- Shiira
Add-ons to investigate
Firefox
- AdBlock
- AdBlock Plus
- NoScript
- CookieCuller
- CookiePie
- VeriSign EV Green Bar Extension
- FirePhish Anti-Phishing Extension
- PhishTank SiteChecker
- Finjan SecureBrowsing
- iTrustPage
- YesScript- JavaScript blacklist
- PwdHash- automatically generates per-site passwords, and the same password for each subdomain; prevents JavaScript from reading your password as it is typed
- Petname Tool
- SafeCache
- SafeHistory
- View Cookies
Internet Explorer
- Online Protection
- SpyWall Anti-Spyware - IE sandbox blocks attacks encountered while browsing the web; detects and removes spyware (not free)
- 1-Click SignupShield Suite - enhanced password manager; protects against phishing fraud and automatically fills out forms; generates unlimited number of unique passwords and disposable Email addresses for signing up to Web sites. It fills sign-up forms and encrypts passwords and Email addresses for later use during sign-in. When you need to sign-in to a Web site, SignupShield automatically retrieves the correct e-mail address and password and fills in the sign-in form for you (not free)
- McAfee SiteAdvisor for IE - protects from spyware, adware, spam, viruses, browser exploits, and online scams. SiteAdvisor has safety ratings.
- Password Scrambler - automatically present unique passwords to the sites you visit, generated from a unique master password you choose. It achieves this by uniquely scrambling your password for every site you visit, so every site gets a unique, secure and hard-to-guess password, while you only remember one.
- Parental Controls
- Pop-up Blockers
- Privacy
Meeting Takeaways
- Malware Prevention
- Haute Secure provides good information and a good user experience
- Blocks pages that are malicious
- Blocks specific malicious content on non-malicious pages, and issues a non-obtrusive warning
- Work with Haute Secure on Firefox extension (currently only for IE)
- StopBadware.org
- Doesn't help character encoding and flash cases
- Requested numbers on the effectiveness of StopBadware.org
- Haute Secure provides good information and a good user experience
- Anti-Phishing
- Default URI blacklist is over 70% effective
- Checking vs. google online yields only slightly better results
- Passwords
- Use SRP (Secure Remote Password) protocol to integrate secure password authentication into applications
- Improve password security by moving away from web-forms
- Sxipper creates strong passwords when registering and encrypts stored data
- Sxipper also saves users time with seamless integration and single click logins
