« previous: Simple Linux Process Accouting | next: AJAX Uploader Supports Multi-File Uploads! »
IE More Secure Than Firefox?
Filed on Nov 15, 2005 by / 2 repliesThe other day, someone told me that they believed Internet Explorer was more secure than Firefox. If it had been just some random person, I would have simply written them off as part of the uninformed/uneducated/unwashed masses, but this was someone who works in the computer industry and knows a ton about these kinds of things.
I was flabbergasted; I didn’t even know how to respond. I didn’t know there actually existed people who could believe something like that.
When I regained my wits, I did some quick research to make sure it wasn’t me who was crazy. Here’s what I found:
SecurityFocus:
IE: 64 vulnerabilities
Firefox: 0 vulnerabilities (select latest version after page loads)CERT:
IE: 161 vulnerability notes
Firefox: 34 vulnerability notesSecunia:
IE: 89 vulnerabilities, 21 unpatched; rated "Highly critical"
Firefox: 25 vulnerabilities, 2 unpatched; rated "Less critical"
It’s hard to argue with numbers like that.
Comments:
"It’s hard to argue with numbers like that."
Actually, it’s easy to.
What you found were databases that contained *known* vulnerabilities. The reason there are so many known vulnerabilities in IE is the same reason there are so many known vulnerabilities in Windows compared to MacOS and Linux: because there are orders of magnitude more people *looking* for vulnerabilities in IE compared to Firefox.
Almost everybody on the planet uses IE.
There, I said it.
It’s not "most people", it’s not merely a "majority", it’s an *overwhelming* majority; almost everybody. If you’re a thief, you don’t waste your time learning to crack a safe that 1 bank out of 10 uses, you learn to crack the safe that the other 9 use.
If Firefox had 85+% of the marketshare, exploits would be coming out of the woodwork.
In fact, it’s safe to say, that in Vista, with IE7 running in protected mode, Firefox will be *far* more vulnerable to hackers (assuming it ever gets enough marketshare for the hackers to care).
The reason there are so many known vulnerabilities in IE is ... because there are orders of magnitude more people *looking* for vulnerabilities in IE
That’s true to some extent, but it’s not the whole story, and your final comment regarding Vista illustrates it nicely. One of the reasons IE is so insecure is because Windows is so insecure and IE hooks into Windows in insecure ways (hello, ActiveX). With IE running in "protected mode" as it should have been all along, and on a new version of Windows that actually has half-decent privilege separation, IE will be much less insecure.
Reply to this message here:
[ archives ]