Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Mozilla Security The Internet

FireFox as a Security Risk Compared to IE? 174

Posted by Cliff from the that's-just-silly-talk dept.
A not-so anonymous Anonymous Coward asks: "The administrator at my work gave me the following reason for not using Mozilla. What do you think? 'FireFox is a security risk. Please refrain from using it. Please continue to use IE 6.0. IE is our only supported browser. FireFox saves encrypted pages to disk and does not give you override capability. It also does not allow automatic cache clearing when closing a browser. These are security risks.'" Do any of you have information that could be used to contradict the administrators information on FireFox? Are there configuration options one can reach from about:config that a user can use to address the problem this administrator has cited?
This discussion has been archived. No new comments can be posted.

FireFox as a Security Risk Compared to IE? More

FireFox as a Security Risk Compared to IE?

Comments Filter:

  • Simple. (Score:5, Informative)

    by mewyn ( 663989 ) on Friday November 26, 2004 @05:24PM (#10927321) Homepage
    Turn off caching. In the configuration, privacy, cache set that to 0, and caching is now disabled. Now, why anyone would claim that Mozilla/Firefox is less secure IE because of their own idocy should be shot.

    • Re:Simple. (Score:5, Informative)

      by Anonymous Coward on Friday November 26, 2004 @08:58PM (#10928387)
      "The administrator at my work gave me the following reason for not using Mozilla."

      Someone's not going to be an anonymous coward for long...

      "FireFox is a security risk. Please refrain from using it"

      LOL. Very good.

      "IE is our only supported browser"

      Please don't make me change anything. I might have to test it.

      "FireFox saves encrypted pages to disk and does not give you override capability. It also does not allow automatic cache clearing when closing a browser. These are security risks.'"

      OMG, people write this stuff?

      Internet Explorer runs programs if you put them in an XML stylesheet, it runs programs supplied in bitmap images, allows websites to save scripts to disk and run them from the "trusted" zone, and allows any website to run activeX programs with full access to your computer if you ever click OK to a dialog box. These are security risks.

  • Adminstrator is full of it (Score:5, Informative)

    by abartlett_219 ( 600259 ) <anoncow&gmail,com> on Friday November 26, 2004 @05:27PM (#10927340) Journal
    browser.cache.disk_cache_ssl? Q.19 here [mozilla.org]

    by default, ssl cache is disabled on firefox.

  • Spite him. (Score:5, Funny)

    by Anonymous Coward on Friday November 26, 2004 @05:30PM (#10927354)
    Use MSIE and access as many problem pages as you can so that you end up with a system filled with viruses, spyware, adware, popups and everything else until the machine slows to a crawl and then let IT deal with it.
  • The corps are under constant pressure to use MS software. The admin is just passing that on.

    • Re:Just pressure from MS (Score:5, Informative)

      by sepluv ( 641107 ) <blakesley&gmail,com> on Friday November 26, 2004 @08:47PM (#10928333)
      There is a lot in this (especially with governments). I'm currently *trying* to persuade my uni have more free software on public machines starting with Firefox. I'll give some recent examples from my experience of this in relation to Firefox (as well as the obvious minor stuff like the government only producing documents in MSWord format or WWW sites that are in MSHTML so only work in MSIE):
      1. In my old (state) college (where I've just left) the sysops told me (in person) that we were not allowed to use Firefox because and I quote, "Firebird [as it was] is a hacking [sic, should be cracking] tool like Kuzu [sic, should be Kazaa]". They also denied that it was a WWW browser and said that MSIE was the only WWW browser. They also said that they have a policy of only using Microsoft's software on the PCs.

      2. A friend of mine uninstalled Firefox because his ISP told him that they did not support their users connecting to the WWW using Firefox. They also told him that just using MSIE (without uninstalling Firefox) instead would not work as Firefox also stops MSIE from connecting to the Internet when it is installed. (The same ISP also said that they only allow their users to check their email with Outlook Express and that my friend should not install any other mail client.)

      I could go on...

      • Re:Just pressure from MS (Score:5, Interesting)

        by legirons ( 809082 ) on Friday November 26, 2004 @09:29PM (#10928509)
        "the obvious minor stuff like the government only producing documents in MSWord format or WWW sites that are in MSHTML so only work in MSIE"

        It could be worse. Your government could demand that all tax returns be filed electronically, make it illegal to not file electronically, and then create a website for filing so that it can't be used on non-Internet Explorer browsers [theregister.co.uk]

        Of course, no real government would ever be that retarded.
        • No...this has to have been a late April Fool's joke...May?...Could just be...
          It could be worse. Your government could demand...
          As I'm as UK citizen and that article is about my government and I didn't know about it before you mentioned it, it know is worse, thank you very much ;-)

          (When I said "the government" in grandparent I was talking about UK government obviously.)

        • In Poland only electronical way to submit tax returns is by Windows-only closed-source program "Patnik" (made by Prokom, an unlawful goverment software monopolist)

          Software itself is bloated s**t and government refuses to make it open-source. Bribes, bribes, bribes...
      • i have seen many ISPs do simular things. Recently had one claim they don't support SSH or VPN conections form an ADSL line that i payed to have a public ip adress. After going thru thier flunky tech suport staff i decided to ask for the supervisors while trying to explain that thier routers were blocking the ports and i paid to have them opened with the service they sold me.

        After about 2 days of running around i finally called the saleman and he went onto a 3 way with the support personel and basicaly told
        • speaking of dumbshot admins, in my school district, i brought in my laptop running linux. admin comes into my room one day to do a tech inventory (since it was MY computer, i could do whatever the hell i wanted with it), and he can't understand how i can access the interent as "novell doesn't support linux". (this was 5 years ago.) he didn't understand tcp/ip. then, he couldn't see how i could access my novell shares (he didn't understand ipx). then, for my web design class, i had an old P200 i scroung
    • Can someone mod this poor guy up?

      I'm not *necessarily* saying /. mods are all smoking something[*] but...I feel really guilty because my reply to his post basically repeating what he said and agreeing with him got modded +5 informative whereas his original post got modded Flamebait.

      [*] which incidentally means that /.ers are all smoking something as nearly all if us are mods at some point.

  • Call Bullshit (Score:5, Informative)

    by TrebleJunkie ( 208060 ) <ezahurakNO@SPAMatlanticbb.net> on Friday November 26, 2004 @05:33PM (#10927367) Homepage Journal
    I think I'm going to have to call bullshit on your admistrator.

    In about:config, the property you want to look for is:

    browser.cache.disk_cache_ssl

    From This Page: [lockergnome.com]

    * Description: switch to enable caching of objects served over a secure connection (SSL).
    * Type: boolean
    * Default: false
    * Recommendation: true on systems where it is secure to cache these objects.

    By default, Firefox (and Mozilla. and Netscape.) will *NOT* cache SSL-served pages. And, contrary to your administrator's *other* claim, you most certainly *can* toggle this behaviour in Firefox.

    • Re:Call Bullshit (Score:3, Insightful)

      by Anonymous Coward
      I'm going to go one further and call bullshit on the submitter.

      The problem was non-existent, and a fix plain and simple in the config. This entire article is a made up troll to rile up the mozilla zealots.

      • >This entire article is a made up troll to rile up the mozilla zealots.

        Christ, just as I was getting my pitchfork and trying to light a torch. Oh well, maybe next time.
    • Hmm, after a quick look in about:config, I couldn't see anything that lets you clear disk cache on exit?
      • Since SSL pages aren't saved to disk by default, it's not much of an issue. Besides, if you don't need your cache to persist across sessions, you can probably get by with no disk cache, just memory.

        Of course, that doesn't directly answer your question, but this is slashdot after all ;-)

      • Someone pointed out that about:config lets you set browser.cache.memory.enable=TRUE (the default) and browser.cache.disk.enable=FALSE. This (apparently) disables Firefox's disk cache, so there is nothing cached to clear when you exit!

    • The Bullshit ... (Score:4, Informative)

      by tqft ( 619476 ) <`moc.oohay' `ta' `ua_sworrubnai'> on Friday November 26, 2004 @07:44PM (#10928037) Homepage Journal
      is that the sysadmins security bots cannot read the cache and see what people have been up to (though he should be able to see the server logs).

      Besides what you have written Kiosk mode should fix everything.

    • Re:Call Bullshit (Score:3, Interesting)

      by klui ( 457783 )
      But I can still save an encrypted page to disk using Firefox's File>Save. I cannot using IE. I personally like Firefox's behavior because if I can see it, I should be able to save it. Not being able to save it is a good option for those who want that behavior. And auto-clearing cache/cookies would be a great option to also have within FF's options. Let's see how fast the Firefox coders implement these functionalties. I'd give it a week.
      • Bah. PrintScreen + OCR. Granted, it's more work, but then if you have hostile users you must keep them from pen and paper....
      • Of course you can -- why wouldn't you want to?

        I can think of a number of commercial sites that would be rendered useless if you couldn't save a page/file that's been delivered via SSL.
      • Call bullshit on this, too. IE will happily save SSL served pages, even with the "save SSL files to disk" option turned off. Explicitly saving is a totally different animal, from both a usability and a security standpoint, than cache saving anyway.
        • But in IE I can check "Do not save encrypted pages to disk" and enforce that through a group policy and prevent a "normal" user from changing it. I have tried this and IE will not save encrypted pages. It will save an almost empty .html file but it will not display the contents. So bullshit on your bullshit. :)

  • Depends on your admin (Score:5, Insightful)

    by green pizza ( 159161 ) on Friday November 26, 2004 @05:33PM (#10927369) Homepage
    I worked in an all-Windows shop for awhile. It wasn't too bad and the network and server admins were *very* tuned into the security notices from Microsoft. They would have every machine patched within one business day of the announcement. Maybe your company is the same way, and introducting non-Microsoft software may upset that cycle.

    • I hope that your admins test out the patches before they install them on production systems. I can't tell you how many times our Exchange server has been knocked out, due to a MS patch. Then, after about a day and a half without e-mail, a "hotfix" gets installed, which lets us have our mail again.

    • ...trashing eighty thousand machines in one hit. Then tell me again why this...
      They would have every machine patched within one business day of the announcement.
      ...is a good thing?

  • Just tell him (Score:2, Funny)

    by Anonymous Coward
    Even Microsoft uses Firefox [yahoo.com].

  • Any non-standard app is a security risk (Score:5, Interesting)

    by SoundGuy666 ( 467270 ) on Friday November 26, 2004 @05:56PM (#10927491)
    While your admin may have issues with the default configuration for Firefox, there are genuine reasons for not deploying firefox to your network. Most security concious organisations have a very rigourous patching system for the authorised applications and operating systems. Any app which doesn't fit into that patching system (whether it be up2date, apt-get, SUS/WUS/SMS, yum or another flavour) presents a massive overhead to the IT team. Every time there is an update to Firefox, it needs to be repackaged and redeployed to every desktop in your organisation. And it's not just Firefox, but by setting a precedent of deploying MyRequestedAppX, they face pressure from all sides for AppY, AppZ, etc. Then the questions come - "you support Mr X's AppX with updates and patches - why not mine?".

    Unless your organisation has the infrastructure to deal with non-baseline application patching, those apps WILL present a security risk while the IT team tries to find the resource to patch/update and deploy the latest version.

    • that's not what he said (Score:4, Insightful)

      by jeif1k ( 809151 ) on Friday November 26, 2004 @06:50PM (#10927752)
      But the admin didn't say "please use IE because we have defined patch and update mechanisms in place and we don't have the resources to do that for FF as well", the admin said "please use IE because FF is a security hole because [a bunch of bogus reasons]".
      • I think that idiotic admin is irrelevent here. I think the problem that the parent mentioned is real, and it ought to be solved.
        • I think that idiotic admin is irrelevent here. I think the problem that the parent mentioned is real, and it ought to be solved.

          What's there to be solved? Firefox has a built-in update mechanism, you can get third party automatic package updates for Windows, and you can install Linux, which provides you with fully automatic updates. What more do you want?

          • Re:that's not what he said (Score:4, Insightful)

            by francium de neobie ( 590783 ) on Friday November 26, 2004 @08:35PM (#10928267)
            Firefox's automatic update is good for the individual. But for IT departments, they'd want to test the patches before releasing them and they'd want to centralize the patching process. I think it's well known what happens if we let the non-computer savvy users choose whether to update or not themselves, or forcing them to take on untested patches ;^) (even the Linux kernel had problematic updates, remember 2.4.11?). So depending on Firefox's automatic update would likely make a mess sooner or later.

            I don't know what you mean by "third party automatic package updates for Windows", but the third option is obviously nonsense. Converting to Linux is not a trivial undertaking for a company.
            • Depending on how you in interperet a "third party tool", ZENWorks, amongst others would qualify. If they poster means some kinda meta-IT department that produces network-deployable packages, then I dont know. I doubt it.

            • Firefox's automatic update is good for the individual. But for IT departments, they'd want to test the patches before releasing them and they'd want to centralize the patching process. I think it's well known what happens if we let the non-computer savvy users choose whether to update or not themselves, or forcing them to take on untested patches ;^)

              Yeah, that's a really great plan, and never has problems [slashdot.org] if you stick to sysadmin-friendly Microsoft kit. ;-)

              Did you ever get the feeling that the linked

            • I don't know what you mean by "third party automatic package updates for Windows"

              ZENWorks, [novell.com] is a third party option. And if your running a Novell network, it is practically mandatory. Sure it costs a lot (last time I looked, it was $70/seat), but if you have a VLA it becomes practically free. Anyway, whatever the cost, with the proper deployment it will save at least an FTE, and free up the guys admining the network to do something else in there free time. Why can it free up so much time? Simple the

      • In my experience, I've heard admins spout bogus reasoning in response to a user that just isn't listening to what they say. Eventually, SOMETHING gets across to said user, and it hopefully has the desired effect.

    • Re:Any non-standard app is a security risk (Score:4, Interesting)

      by Damhna ( 56361 ) on Friday November 26, 2004 @06:51PM (#10927755)
      Could not agree more.

      Custom application standardisation across the install base means that issue resolution can be standardised and tweaked to meet the response/support requirement. The certification and testing processes that most serious companies use to pass apps as fitting are both rigourous and not condusive to incorporating the latest 'app du jour'. And rightly so.

      It's easy for tech saavy folks to deem these practices as a symptom of the narrow mindedness of lazy MCSE admins (who would appear to be some sort of subspecies of a real admins). It's easy to see this as an organisation being inflexible due to undereducation but I believe that that is not the case. A pestered admin will often give the sort of pseudo answer this user recieved.It's not good to fudge that way , but without taking a user step by step through the security policies and application certification documetnation, it's difficult to explain the why of decisions such as this.

      It can be difficult to meet the job function requirements of diverse departments and maintain the steady balancing act that will ensure your SourceSafe users will be as compliant as the receptionist.

      For this organisation it may be useful to do a business case analysis exploring the usefulness or otherwise of Firefox but as it is still in it's first iteration a lot of companies will be loathe to abandon the practices they have in place on a whim.

      Aa firefox moves ever closer to a dominant position the pressure will become greater and things will change. It will also become more a target and I'm betting that this [secunia.com] will begin getting longer and looking far more serious as more and more authors start realising the potential success to be had in taking Firefox on.

    • How is it "overhead" for the IT team to look at Firefox just once to see that it already does automatically keep itself up-to-date if you tell it to? That and all its extensions. I have yet to see a Google bar or some such (can anyone say "Comet Cursor"?) keep itself up-to-date on IE.
    • IT, keeping up to date?, Patching?

      Hmm well coming from speaking from one very large company in the UK it seems that would be the exception rather than the norm.

      Here we use NT 4 SP5 (maybe 5a, certainly not 6) and ie 5.5 and well hey most of the machines here are spyware infested and getting it to sort it out is so complicated thank to having to ring an offsite call centre who ring someone back on site to come out to have a look (don't you love modern it policy) who will generally just boot from the notwor

  • funny your admin should say that... (Score:3, Interesting)

    by blackcoot ( 124938 ) on Friday November 26, 2004 @06:05PM (#10927536)
    ... because i've switched all the machines i'm responsible for to using firefox precisely because it's n-times harder to get malware. not impossible mind, but a lot harder by default. perhaps inducing some blunt trauma with a clue-by-four might help...

  • Firefox does not save encrypted pages to disk (Score:2, Informative)

    by Anonymous Coward

    FireFox saves encrypted pages to disk and does not give you override capability.

    That is a complete fucking lie. Unlike the security train wreck that is Internet Explorer, Firefox (and Mozilla and Netscape and ever other browser designed by people with a semblance of knowledge about security) does not save encrypted pages to the disk cache by default. Internet Explorer does (can be disabled by unchecking the 'Do not save encrypted pages to disk' box on the Advanced tab of the Internet Options dialogue).

  • set browser.disk_cache_ssl to false.
    it's set to false by default, btw. :)

  • Also in recent news... (Score:4, Funny)

    by comwiz56 ( 447651 ) <{moc.liamg} {ta} {ziwmoc}> on Friday November 26, 2004 @06:26PM (#10927638) Homepage
    Also in recent news: jumping into a pit of lava is safer than swimming in your friends swimming pool.

  • Nobody's Mentioned This So I am... (Score:5, Interesting)

    by DiscoOnTheSide ( 544139 ) <ajfili&eden,rutgers,edu> on Friday November 26, 2004 @06:59PM (#10927791) Homepage
    There's a wonderful little extension for Firefox called "Configuration Mania" and it works with 1.0. It has the ability to choose the option for the SSL disk cache mode as well as clear the disk cache every time you close the program, as well as other nifty little things. Give it a whirl.

  • Dear slashdot... (Score:5, Funny)

    by pyrros ( 324803 ) on Friday November 26, 2004 @07:07PM (#10927836)
    Dear slashdot, a friend of mine claims that his dad can beat my dad. Do any of you have information that could be used to contradict my friend's information on my dad, as I can't be bothered to check? Are there any options one can pursue (anabolics, boxing classed etc), that a kid can use to address the problem this friend has cited?

  • FirefoxIE (Score:5, Interesting)

    by file cabinet ( 773149 ) on Friday November 26, 2004 @07:45PM (#10928044) Journal
    http://www.firefoxie.net/ [firefoxie.net]
  • As someone else here mentioned, allowing the installation of Firefox would disrupt the usual patching routines, since the admins want to minimize the number of things to be watched over (i.e. if I let you install Firefox, then besides Microsoft's updates, I have to watch for Mozilla.org's updates too.) I can imagine the admins are already in deep shit with the Microsoftian legion of security flaws, but (un)luckily Microsoft has provided a rather automatic means of unattended update for IT administrators to
    • since the admins want to minimize the number of things to be watched over (i.e. if I let you install Firefox, then besides Microsoft's updates, I have to watch for Mozilla.org's updates too.)

      This sort of makes sense if *all* you ever run is MS Office, MS Small Biz Server, IIS, etc. But if your org needs to run other things (Raiser's Edge, QuickBooks, Adobe products, etc.)

      It used to be people chose to run Windows vs. Linux or Mac because 'Windows has all the software'. But it seems now more IT depts are
  • Here's an email I just sent to my company's sysadmin... what you think? (Hotel with ~100 desktops)

    We discussed installing firefox on all machines...

    After some thought and reading I'm not sure that's the right move now...

    + I like firefox
    + No ActiveX
    - No easy autoupdater that I'm aware of
    - Not controllable via Group Policy

    Related discussion: http://ask.slashdot.org/article.pl?sid=04/11/24/1 8 41232

    Web's getting nasty; I worry mostly about users going to our regions account (I don't know who has access,

    • I don't think we should install firefox until we can get it to autoupdate

      It does.

      maybe not until it's controllable by GP

      Interesting project for the FF people, damn sure MS won't implement it until the Styx becomes icebound despite this [yahoo.com].

      Maybe IE will become somewhat secure before that happens.

      Maybe if you leave enough teeth under your pillow, they will get swapped for negotiable cash overnight.

      We need to disable ActiveX in group policy

      This will kill some idiot PHB's favourite site and thus get rej

  • Your system admin... (Score:3, Interesting)

    by CaptainTux ( 658655 ) <papillion@gmail.com> on Friday November 26, 2004 @11:57PM (#10929097) Homepage Journal
    What your system admin says is true. But consider this: with Firefox, one would probably have to have physical access to your machine to make any use of the information Firefox stores. With IE, one only needs to "reach out and touch you" using a malicious webpage or email.

    IMHO, Firefox is more of a local security risk that could expose your sensitive data to others who use your computer. IE, OTOH, could expose your data to anyone on the internet.

  • I work at a MS-Friendly company (I'd say Microsoft is one of our major customers) and as they gave me Administrator permissions to my machine, I did not even ask if I could install Firefox - I simply got it installed. Once the sysadmin saw and told me I should not use non-IE browsers. I answered him that as a web developer, it was my job to test everything in the most popular browsers and that IE now has less than 90% of market. He didn't knew that and while he was trying to answer something-too-complex-for

  • Just post... (Score:3, Insightful)

    by jalet ( 36114 ) <alet@librelogiciel.com> on Saturday November 27, 2004 @02:43AM (#10929671) Homepage
    your sysadmin's email address here.

    This will make him know better !

  • One real reason not to use it (Score:4, Informative)

    by drsmithy ( 35869 ) <drsmithy&gmail,com> on Saturday November 27, 2004 @03:56AM (#10929817)
    Your admin's claims, as others have noted, are BS.

    However, one reason I haven't rolled out Firefox across the board here is because it's a pain to centrally distribute, update and administer.

    A word to the Firefox devs - if you really want to start making an impact into the corporate world:

    Make centralised admin of Firefox under Windows easy and standard with GPOs (or even for just a start, obey the system-wide settings for things like homepages and proxies).

    Package it into an MSI.

    On a more personal note, fix the damn copy and paste bug that's been hanging around since (at least) the Firefox 0.7 days. It doesn't stop me using it (or recommending it to others), but it *does* make it EXTREMELY FRUSTRATING sometimes.

  • Good. Coming at you from a risk point of view.

    Risk of IE - lots of vulnerabilities that are mainly high risk according to vendor. Threat is you get lots of spyware etc just by visiting sites. Probability of this happeningis high.

    Risk of Firefox. few known vulnerabilities, mainly low risk occording to vendor.

  • Any system administrator who thinks that IE is more secure than any other piece of software is not a system administrator at all. Nay, he has the mental capacity of a dead fly.

    IE is not secure. Nor is it more secure than other software.

    To compare the security of various packages, do this:

    Install a Linux box. Install it with 10 NICs connected to 10 DS-3 connections to the Internet, with static IPs. Use no firewall. Open every port. Install every service. Run everything under 'root'. Serve web pages explainin

  • Admin idiots (Score:2, Informative)

    by Hippynz ( 835181 )
    I once turned down a job because of stupid admin staff.
    At the interview I asked what they used and if they allowed staff to install more secure aps if the ones they use are not secure. They said no, I explained FireFox and others (for email etc) and was told they would not look at it. I then told them (when I got accepted for the job) that I could not work for a company that does not take computer security seriously (or even takes advice of the issue). Ended up working for a croup that had a better approac

Slashdot Top Deals

It is easier to write an incorrect program than understand a correct one.

Close