CFA/Security-Research

« Comparative Feature Analyses
« Security Notes

General Browser Capabilities

• Anti-Phishing
• Malware Detection
• Passwords
• Content Enabling
• Cookies
• Warning Messages
• Encryption (Protocols and Certificates)
• Other

Purpose

Examine a bunch of browsers, existing Firefox Add-ons, and web services to generate a report that describes:

• Which capabilities each has
• A summary of where each is different/unique
• Some conclusions about which aspects seem most innovative and interesting that we might want to consider for Firefox

Browsers to investigate

• Firefox 2
• Camino
• Flock
• iCab
• IE 7
• Maxthon
• Netscape
• OmniWeb
• Opera
• Safari
• SeaMonkey
• Shiira

Add-ons to investigate

Firefox

• AdBlock
• AdBlock Plus
• NoScript
• CookieCuller
• CookiePie
• VeriSign EV Green Bar Extension
• FirePhish Anti-Phishing Extension
• PhishTank SiteChecker
• Finjan SecureBrowsing
• iTrustPage
• YesScript- JavaScript blacklist
• PwdHash- automatically generates per-site passwords, and the same password for each subdomain; prevents JavaScript from reading your password as it is typed
• Petname Tool
• SafeCache
• SafeHistory
• View Cookies

Internet Explorer

• Online Protection
  • SpyWall Anti-Spyware - IE sandbox blocks attacks encountered while browsing the web; detects and removes spyware (not free)
  • 1-Click SignupShield Suite - enhanced password manager; protects against phishing fraud and automatically fills out forms; generates unlimited number of unique passwords and disposable Email addresses for signing up to Web sites. It fills sign-up forms and encrypts passwords and Email addresses for later use during sign-in. When you need to sign-in to a Web site, SignupShield automatically retrieves the correct e-mail address and password and fills in the sign-in form for you (not free)
  • McAfee SiteAdvisor for IE - protects from spyware, adware, spam, viruses, browser exploits, and online scams. SiteAdvisor has safety ratings.
  • Password Scrambler - automatically present unique passwords to the sites you visit, generated from a unique master password you choose. It achieves this by uniquely scrambling your password for every site you visit, so every site gets a unique, secure and hard-to-guess password, while you only remember one.
• Parental Controls
• Pop-up Blockers
• Privacy

Meeting Takeaways

• Malware Prevention
  • Haute Secure provides good information and a good user experience
    • Blocks pages that are malicious
    • Blocks specific malicious content on non-malicious pages, and issues a non-obtrusive warning
    • Work with Haute Secure on Firefox extension (currently only for IE)
  • StopBadware.org
    • Doesn't help character encoding and flash cases
    • Requested numbers on the effectiveness of StopBadware.org
• Anti-Phishing
  • Default URI blacklist is over 70% effective
  • Checking vs. google online yields only slightly better results
• Passwords
  • Use SRP (Secure Remote Password) protocol to integrate secure password authentication into applications
  • Improve password security by moving away from web-forms
    • Sxipper creates strong passwords when registering and encrypts stored data
    • Sxipper also saves users time with seamless integration and single click logins