4 ms·

> I've been using Firefox for years without any problems and find it much better (just as fast, more privacy-minded) than chrome. Then you must not value secur

> I've been using Firefox for years without any problems and find it much better (just as fast, more privacy-minded) than chrome. Then you must not value security at all. Firefox is by far the worst of the modern browsers in how easy it's to exploit. Don't listen to me, listen to the experts [1] [2] [3] I would go as far as to say that if Firefox is your main browser, odds are you're owned by multiple parties, and I don't mean nation states. This can not be fixed by iterative improvements, Firefox needs to die. By far the best thing you can do for your online peace of mind is to switch to Chromium/Chrome or (on Windows only) Edge. [1] https://twitter.com/thegrugq/status/803693249789509632 https://twitter.com/thegrugq/status/803693249789509632 [2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908 https://medium.com/@thegrugq/tor-and-its-discontents-ef51648... [3] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...

yborg 10y ago
Your statement may be valid, but the two links you provided don't seem to have much to say on that topic. The first refers to a bug currently fixed in current GA Firefox, the second is a rant about Tor bundle. If reblogging snark is the standard of proof here, anyone could justify any "modern browser" as "worst". My counterargument is that Firefox has always and continues to support tools such as NoScript and uBlock that prevent whole classes of attack. And Chrome, for example, is pwned like clockwork at every contest for exploitation. Behavior and not platform is the biggest determinant of security online.
- armitron 10y ago
  If you're talking about Pwn2own, they've dropped Firefox from the competition __because it was too easy to exploit__ [1]. I quote: "For the last decade, the Pwn2own hacking competition has pitted the world's best hackers against web browsers to try and find zero-day vulnerabilities in a live event. The contest, which is sponsored by HPE and TrendMicro this year, is offering over half a million dollars in prize money, but for the first time, not a penny of that will directed to Mozilla Firefox. While Microsoft Edge, Google Chrome and Apple Safari are targets, Firefox isn't because it's apparently too easy and not keeping up with modern security: "'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said." How is that for a slap in the face? Selectively reading what you like and ignoring the rest [an entire section in the second link is devoted to Firefox issues that have nothing to do with TBB, including the conclusion] won't change the basic facts. Another point those not in the security domain miss, is that there are plenty of exploitable bugs that are deliberately kept private. Those who have visibility in these circles (such as thegrugq) are obviously in a much better position to appraise how secure a software system really is. Trying to determine how secure Firefox is just from CVEs and bugs that are made public will only lead you to a piece of the entire puzzle. In Firefox case, even that alone should be enough to trigger RED ALERT in somebody's mind. The best we can all hope for is for people to stop using Firefox and flock to alternatives that raise the bar significantly. [1] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...
  - librexpr 10y ago
    And yet according to these sources[0][1], Firefox is back this year in Pwn2own. A quote from [1]: > "Mozilla improved their security enough for us to warrant their re-inclusion in the contest," Gorenc said. Firefox is fine. Like in every other browser, when security problems are found, they are fixed. There's a lot of work going into making Firefox a great and secure browser, and to call for abandoning it en masse is unwarranted IMO. Edit: Heck, isn't it your own link[2] that claims that one of the security problems with Tor is their homogeny, that they all use the same browser and version? By that logic, abandoning Firefox is a bad move for overall security. [0] https://blog.trendmicro.com/pwn2own-returns-for-2017-to-celebrate-10-years-of-exploits/ https://blog.trendmicro.com/pwn2own-returns-for-2017-to-cele... [1] http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linux-servers-and-web-browsers.html http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linu... [2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908 https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...
    - armitron 10y ago
      Look at the prize money for Firefox, lowest of them all. I think this proves my original point. TBB is routinely attacked by nation states and other government groups. In that context, homogeneity is an important factor since they only have one target to focus on and considerable resources to use. By the way this is also another point against someone using Firefox. By choosing Firefox, you are choosing a browser that __you know__ is actively targeted by nation states and government groups, because it's used in TBB. You can safely assume said groups have multiple Firefox 0days. My original point however is not that Firefox is insecure vs nation-grade attackers. __Every browser is__ There are plenty of criminal groups (ever increasing) and actors with limited resources that will focus on Firefox because it's easy to exploit. The fricking FBI was owning people with a Firefox 0day. The same groups would find Chrome or Edge too hard. This is of course a personal evaluation, given what I know from conversations with people in the security domain. Let me leave you with this piece of (anecdotal) information: In my last job, we used to have new hires for exploit development pick a browser to work on for the first few months. Expectation being remote exploits, lots of them. Most of them picked Firefox.
    - 10y ago

yborg 10y ago

Your statement may be valid, but the two links you provided don't seem to have much to say on that topic. The first refers to a bug currently fixed in current GA Firefox, the second is a rant about Tor bundle. If reblogging snark is the standard of proof here, anyone could justify any "modern browser" as "worst". My counterargument is that Firefox has always and continues to support tools such as NoScript and uBlock that prevent whole classes of attack. And Chrome, for example, is pwned like clockwork at every contest for exploitation. Behavior and not platform is the biggest determinant of security online.

armitron 10y ago
If you're talking about Pwn2own, they've dropped Firefox from the competition __because it was too easy to exploit__ [1]. I quote: "For the last decade, the Pwn2own hacking competition has pitted the world's best hackers against web browsers to try and find zero-day vulnerabilities in a live event. The contest, which is sponsored by HPE and TrendMicro this year, is offering over half a million dollars in prize money, but for the first time, not a penny of that will directed to Mozilla Firefox. While Microsoft Edge, Google Chrome and Apple Safari are targets, Firefox isn't because it's apparently too easy and not keeping up with modern security: "'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said." How is that for a slap in the face? Selectively reading what you like and ignoring the rest [an entire section in the second link is devoted to Firefox issues that have nothing to do with TBB, including the conclusion] won't change the basic facts. Another point those not in the security domain miss, is that there are plenty of exploitable bugs that are deliberately kept private. Those who have visibility in these circles (such as thegrugq) are obviously in a much better position to appraise how secure a software system really is. Trying to determine how secure Firefox is just from CVEs and bugs that are made public will only lead you to a piece of the entire puzzle. In Firefox case, even that alone should be enough to trigger RED ALERT in somebody's mind. The best we can all hope for is for people to stop using Firefox and flock to alternatives that raise the bar significantly. [1] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...
- librexpr 10y ago
  And yet according to these sources[0][1], Firefox is back this year in Pwn2own. A quote from [1]: > "Mozilla improved their security enough for us to warrant their re-inclusion in the contest," Gorenc said. Firefox is fine. Like in every other browser, when security problems are found, they are fixed. There's a lot of work going into making Firefox a great and secure browser, and to call for abandoning it en masse is unwarranted IMO. Edit: Heck, isn't it your own link[2] that claims that one of the security problems with Tor is their homogeny, that they all use the same browser and version? By that logic, abandoning Firefox is a bad move for overall security. [0] https://blog.trendmicro.com/pwn2own-returns-for-2017-to-celebrate-10-years-of-exploits/ https://blog.trendmicro.com/pwn2own-returns-for-2017-to-cele... [1] http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linux-servers-and-web-browsers.html http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linu... [2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908 https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...
  - armitron 10y ago
    Look at the prize money for Firefox, lowest of them all. I think this proves my original point. TBB is routinely attacked by nation states and other government groups. In that context, homogeneity is an important factor since they only have one target to focus on and considerable resources to use. By the way this is also another point against someone using Firefox. By choosing Firefox, you are choosing a browser that __you know__ is actively targeted by nation states and government groups, because it's used in TBB. You can safely assume said groups have multiple Firefox 0days. My original point however is not that Firefox is insecure vs nation-grade attackers. __Every browser is__ There are plenty of criminal groups (ever increasing) and actors with limited resources that will focus on Firefox because it's easy to exploit. The fricking FBI was owning people with a Firefox 0day. The same groups would find Chrome or Edge too hard. This is of course a personal evaluation, given what I know from conversations with people in the security domain. Let me leave you with this piece of (anecdotal) information: In my last job, we used to have new hires for exploit development pick a browser to work on for the first few months. Expectation being remote exploits, lots of them. Most of them picked Firefox.
  - 10y ago